diff --git a/.ast-grep/rules/component-literals-only-in-rules.yml b/.ast-grep/rules/component-literals-only-in-rules.yml
new file mode 100644
index 0000000..8c00072
--- /dev/null
+++ b/.ast-grep/rules/component-literals-only-in-rules.yml
@@ -0,0 +1,30 @@
+# Invariant 5: signer and verifier agree on every rule. The profile's
+# component lists are stated once, in rules.py, and both roles read them.
+# A component identifier written anywhere else is a second copy of a rule.
+id: component-literals-only-in-rules
+language: Python
+severity: error
+message: Component identifiers are stated once, in rules.py; signer, verifier, and directory read them from there.
+files:
+  - "src/iab_agentic_primitives/web_bot_auth/**/*.py"
+ignores:
+  - "src/iab_agentic_primitives/web_bot_auth/rules.py"
+  # Fixture data: the scenarios list deliberately wrong components, as scenarios.json spells them.
+  - "src/iab_agentic_primitives/web_bot_auth/conformance/scenarios.py"
+rule:
+  kind: string
+  any:
+    # The first argument of component_id("content-digest"), _key("@method"),
+    # and the like.
+    - all:
+        - nthChild: 1
+        - inside:
+            kind: argument_list
+            inside:
+              kind: call
+              has:
+                field: function
+                regex: '^(component_id|component_key|_key)$'
+    # A bare derived-component name such as "@target-uri" or '"@method";req'.
+    # A docstring opens with three quotes, so the regex never matches one.
+    - regex: '^["'']"?@[a-z-]+'
diff --git a/.ast-grep/rules/library-verify-checks-components-and-body.yml b/.ast-grep/rules/library-verify-checks-components-and-body.yml
new file mode 100644
index 0000000..a686f82
--- /dev/null
+++ b/.ast-grep/rules/library-verify-checks-components-and-body.yml
@@ -0,0 +1,25 @@
+# The RFC 9421 seam hands the library the components the profile requires and
+# the covered body, so the library checks them as well as the profile does
+# (invariant 1). The profile's own checks run first, so no behavior test can
+# tell the library's checks apart; this rule keeps them in place.
+id: library-verify-checks-components-and-body
+language: Python
+severity: error
+message: The seam's call to the library verifier passes require_components= and body=.
+files:
+  - "src/iab_agentic_primitives/web_bot_auth/_sig.py"
+rule:
+  pattern: $V.verify($$$ARGS)
+  any:
+    - not:
+        has:
+          kind: argument_list
+          has:
+            kind: keyword_argument
+            regex: "^require_components="
+    - not:
+        has:
+          kind: argument_list
+          has:
+            kind: keyword_argument
+            regex: "^body="
diff --git a/.ast-grep/rules/no-absolute-self-import.yml b/.ast-grep/rules/no-absolute-self-import.yml
new file mode 100644
index 0000000..4f991b9
--- /dev/null
+++ b/.ast-grep/rules/no-absolute-self-import.yml
@@ -0,0 +1,21 @@
+# The module is self-contained: it reaches its siblings through relative
+# imports only, so it can be vendored or moved without edits.
+id: no-absolute-self-import
+language: Python
+severity: error
+message: web_bot_auth is self-contained and uses relative imports only.
+files:
+  - "src/iab_agentic_primitives/web_bot_auth/**/*.py"
+rule:
+  any:
+    # import iab_agentic_primitives, import iab_agentic_primitives.x as y
+    - kind: import_statement
+      has:
+        stopBy: end
+        kind: dotted_name
+        regex: '^iab_agentic_primitives(\.|$)'
+    # from iab_agentic_primitives.x import y
+    - kind: import_from_statement
+      has:
+        field: module_name
+        regex: '^iab_agentic_primitives(\.|$)'
diff --git a/.ast-grep/rules/no-cross-module-private-import.yml b/.ast-grep/rules/no-cross-module-private-import.yml
new file mode 100644
index 0000000..465efc9
--- /dev/null
+++ b/.ast-grep/rules/no-cross-module-private-import.yml
@@ -0,0 +1,44 @@
+# A private name belongs to its module. Another module reaches it only
+# through a public seam, so the layer order cannot be bypassed by an import,
+# and a test reaches the module only through its public surface.
+id: no-cross-module-private-import
+language: Python
+severity: error
+message: A private name belongs to its module; another module imports it only through a public seam.
+files:
+  - "src/iab_agentic_primitives/web_bot_auth/**/*.py"
+rule:
+  kind: dotted_name
+  regex: '^_[a-z]'
+  inside:
+    kind: import_from_statement
+    any:
+      # from .directory import _checked_max_age
+      - has:
+          kind: relative_import
+          regex: '^\.+[a-z]'
+      # from iab_agentic_primitives.web_bot_auth.verifier import _select
+      - has:
+          field: module_name
+          regex: '^iab_agentic_primitives\.web_bot_auth(\.[a-z][a-z_]*)+$'
+---
+id: no-cross-module-private-import-in-tests
+language: Python
+severity: error
+message: A test reaches a private name; test the behavior through the public API instead.
+files:
+  - "tests/web_bot_auth/**/*.py"
+rule:
+  kind: dotted_name
+  regex: '^_[a-z]'
+  inside:
+    kind: import_from_statement
+    any:
+      # from .directory import _checked_max_age
+      - has:
+          kind: relative_import
+          regex: '^\.+[a-z]'
+      # from iab_agentic_primitives.web_bot_auth.verifier import _select
+      - has:
+          field: module_name
+          regex: '^iab_agentic_primitives\.web_bot_auth(\.[a-z][a-z_]*)+$'
diff --git a/.ast-grep/rules/no-host-derived-authority.yml b/.ast-grep/rules/no-host-derived-authority.yml
new file mode 100644
index 0000000..8881e8b
--- /dev/null
+++ b/.ast-grep/rules/no-host-derived-authority.yml
@@ -0,0 +1,17 @@
+# Invariant 3: the server's own authority comes from configuration, never
+# from the request. Reading Host, Forwarded, or the ASGI server tuple to
+# decide what the server is would let a client choose the authority a
+# signature is checked against.
+id: no-host-derived-authority
+language: Python
+severity: error
+message: The server's authority comes from configuration (base_url / authorities), never from Host, Forwarded, or scope["server"].
+files:
+  - "src/iab_agentic_primitives/web_bot_auth/**/*.py"
+rule:
+  any:
+    - pattern: $S["server"]
+    - pattern: $S.get("server")
+    - all:
+        - kind: string
+        - regex: '^b?["''](host|x-forwarded-host|forwarded)["'']$'
diff --git a/.ast-grep/rules/refusal-minted-in-one-place.yml b/.ast-grep/rules/refusal-minted-in-one-place.yml
new file mode 100644
index 0000000..3032f30
--- /dev/null
+++ b/.ast-grep/rules/refusal-minted-in-one-place.yml
@@ -0,0 +1,28 @@
+# Invariant 4: every refusal is a typed WebBotAuthError with a status from
+# the profile's table. A refusal is minted from that table in one place, so
+# no call site can pick its own status or reason.
+id: refusal-minted-in-one-place
+language: Python
+severity: error
+message: A refusal is minted in errors.py from a Refusal member; elsewhere, raise refuse(Refusal.X, detail).
+files:
+  - "src/iab_agentic_primitives/web_bot_auth/**/*.py"
+ignores:
+  - "src/iab_agentic_primitives/web_bot_auth/errors.py"
+rule:
+  any:
+    - pattern: WebBotAuthError($$$A)
+    - pattern: $M.WebBotAuthError($$$A)
+---
+# A test asserts a refusal by its Refusal member, through the one helper that
+# checks the member and its status together.
+id: refusal-asserted-through-expect-refusal
+language: Python
+severity: error
+message: Assert a refusal with expect_refusal(call, Refusal.X), not pytest.raises(WebBotAuthError).
+files:
+  - "tests/web_bot_auth/**/*.py"
+rule:
+  any:
+    - pattern: pytest.raises(WebBotAuthError $$$A)
+    - pattern: raises(WebBotAuthError $$$A)
diff --git a/.ast-grep/rules/signature-fields-parsed-once.yml b/.ast-grep/rules/signature-fields-parsed-once.yml
new file mode 100644
index 0000000..95e4470
--- /dev/null
+++ b/.ast-grep/rules/signature-fields-parsed-once.yml
@@ -0,0 +1,30 @@
+# Signature and Signature-Input are parsed by one wire-seam function. Any
+# other module that reads them by name is a second parser whose rules can
+# drift from the first.
+id: signature-fields-parsed-once
+language: Python
+severity: error
+message: Signature / Signature-Input are parsed by one L2 function; nothing else reads them by name.
+files:
+  - "src/iab_agentic_primitives/web_bot_auth/**/*.py"
+ignores:
+  - "src/iab_agentic_primitives/web_bot_auth/_wire.py"
+  # Fixture data: a scenario appends raw members to these fields after signing.
+  - "src/iab_agentic_primitives/web_bot_auth/conformance/scenarios.py"
+rule:
+  all:
+    - kind: string
+    - regex: '^b?["'']signature(-input)?["'']$'
+    - inside:
+        kind: call
+        stopBy: end
+    # component_id("signature", {"req": True, ...}) names the covered
+    # component, not the field; component-literals-only-in-rules owns it.
+    - not:
+        inside:
+          kind: argument_list
+          inside:
+            kind: call
+            has:
+              field: function
+              regex: '^component_id$'
diff --git a/.ast-grep/rules/verified-types-constructed-by-owner.yml b/.ast-grep/rules/verified-types-constructed-by-owner.yml
new file mode 100644
index 0000000..eb6b1ea
--- /dev/null
+++ b/.ast-grep/rules/verified-types-constructed-by-owner.yml
@@ -0,0 +1,31 @@
+# A verified credential is constructed only by the code that verified it, so
+# holding one means the check ran. Tests get one by verifying a real message.
+id: verified-credentials-constructed-by-owner
+language: Python
+severity: error
+message: VerifiedRequest and VerifiedResponse are constructed only in verifier.py.
+files:
+  - "src/iab_agentic_primitives/web_bot_auth/**/*.py"
+  - "tests/web_bot_auth/**/*.py"
+ignores:
+  - "src/iab_agentic_primitives/web_bot_auth/verifier.py"
+rule:
+  any:
+    - pattern: VerifiedRequest($$$A)
+    - pattern: $M.VerifiedRequest($$$A)
+    - pattern: VerifiedResponse($$$A)
+    - pattern: $M.VerifiedResponse($$$A)
+---
+id: verified-directory-constructed-by-owner
+language: Python
+severity: error
+message: VerifiedDirectory is constructed only in directory.py; tests verify a real signed directory.
+files:
+  - "src/iab_agentic_primitives/web_bot_auth/**/*.py"
+  - "tests/web_bot_auth/**/*.py"
+ignores:
+  - "src/iab_agentic_primitives/web_bot_auth/directory.py"
+rule:
+  any:
+    - pattern: VerifiedDirectory($$$A)
+    - pattern: $M.VerifiedDirectory($$$A)
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index ce89032..fa477d0 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -12,8 +12,39 @@ jobs:
       - name: Install uv
         uses: astral-sh/setup-uv@v5
         with:
-          python-version: "3.11"
+          python-version: "3.12"
       - name: Run tests
         run: uv run pytest
       - name: Lint
         run: uv run ruff check .
+
+  # The Web Bot Auth gates, in order: the ruff format check, the ruff lint,
+  # the seam boundary, the structural rules, the import contracts, mypy
+  # strict, and the behavior suite with its coverage floor.
+  quality:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.12"
+      - name: Run the Web Bot Auth quality gates
+        run: make quality
+
+  # The interop tests, which pytest deselects by default: Cloudflare's
+  # web-bot-auth signs and verifies against this library through Node.
+  web-bot-auth-interop:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install uv
+        uses: astral-sh/setup-uv@v5
+        with:
+          python-version: "3.12"
+      - name: Install Node
+        uses: actions/setup-node@v4
+        with:
+          node-version: "22"
+      - name: Run the interop harness against the module's adapter
+        run: make interop
diff --git a/.gitignore b/.gitignore
index 74b5151..bfc77a0 100644
--- a/.gitignore
+++ b/.gitignore
@@ -6,6 +6,10 @@ build/
 *.egg-info/
 .pytest_cache/
 .ruff_cache/
+# Web Bot Auth quality gates (make quality)
+.mypy_cache/
+.import_linter_cache/
+.coverage
 
 # Secrets hygiene
 .env
diff --git a/.importlinter b/.importlinter
new file mode 100644
index 0000000..c04660b
--- /dev/null
+++ b/.importlinter
@@ -0,0 +1,160 @@
+# Import contracts for the Web Bot Auth module (`make imports`). Every one blocks.
+[importlinter]
+root_package = iab_agentic_primitives
+include_external_packages = True
+
+[importlinter:contract:wba-roles-no-network]
+name = values, seams, rules, directory, ports, and roles import no network client (only the fetcher, the edges, and testing do)
+type = forbidden
+source_modules =
+    iab_agentic_primitives.web_bot_auth.presentation
+    iab_agentic_primitives.web_bot_auth.roles
+    iab_agentic_primitives.web_bot_auth.signer
+    iab_agentic_primitives.web_bot_auth.verifier
+    iab_agentic_primitives.web_bot_auth.ports
+    iab_agentic_primitives.web_bot_auth.replay
+    iab_agentic_primitives.web_bot_auth.directory
+    iab_agentic_primitives.web_bot_auth.keys
+    iab_agentic_primitives.web_bot_auth.values
+    iab_agentic_primitives.web_bot_auth.errors
+    iab_agentic_primitives.web_bot_auth.message
+    iab_agentic_primitives.web_bot_auth._wire
+    iab_agentic_primitives.web_bot_auth._sig
+    iab_agentic_primitives.web_bot_auth.rules
+forbidden_modules =
+    httpx
+allow_indirect_imports = True
+
+[importlinter:contract:wba-l0-no-io]
+name = the value, error, key, message, wire, rules, directory, presentation, and ports modules do no I/O (no network, filesystem, event loop, threads)
+type = forbidden
+source_modules =
+    iab_agentic_primitives.web_bot_auth.keys
+    iab_agentic_primitives.web_bot_auth.presentation
+    iab_agentic_primitives.web_bot_auth.ports
+    iab_agentic_primitives.web_bot_auth.directory
+    iab_agentic_primitives.web_bot_auth.rules
+    iab_agentic_primitives.web_bot_auth.values
+    iab_agentic_primitives.web_bot_auth.errors
+    iab_agentic_primitives.web_bot_auth.message
+    iab_agentic_primitives.web_bot_auth._wire
+    iab_agentic_primitives.web_bot_auth._sig
+forbidden_modules =
+    httpx
+    asyncio
+    os
+    pathlib
+    threading
+    subprocess
+allow_indirect_imports = True
+
+[importlinter:contract:wba-seam-libs]
+name = only the L2 seams import the RFC 9421 and Structured Fields libraries
+type = forbidden
+source_modules =
+    iab_agentic_primitives.web_bot_auth.keyfile
+    iab_agentic_primitives.web_bot_auth.presentation
+    iab_agentic_primitives.web_bot_auth.roles
+    iab_agentic_primitives.web_bot_auth.signer
+    iab_agentic_primitives.web_bot_auth.verifier
+    iab_agentic_primitives.web_bot_auth.directory
+    iab_agentic_primitives.web_bot_auth.rules
+    iab_agentic_primitives.web_bot_auth.asgi
+    iab_agentic_primitives.web_bot_auth.resolver
+    iab_agentic_primitives.web_bot_auth.ports
+    iab_agentic_primitives.web_bot_auth.fetcher
+    iab_agentic_primitives.web_bot_auth.testing
+    iab_agentic_primitives.web_bot_auth.httpx
+    iab_agentic_primitives.web_bot_auth.replay
+    iab_agentic_primitives.web_bot_auth.keys
+    iab_agentic_primitives.web_bot_auth.values
+    iab_agentic_primitives.web_bot_auth.errors
+    iab_agentic_primitives.web_bot_auth.message
+    iab_agentic_primitives.web_bot_auth.conformance
+    iab_agentic_primitives.web_bot_auth._unchecked
+forbidden_modules =
+    http_message_signatures
+    http_sf
+allow_indirect_imports = True
+
+[importlinter:contract:wba-roles-no-loop]
+name = the roles run no event loop or thread; the sync facade owns the one loop
+type = forbidden
+source_modules =
+    iab_agentic_primitives.web_bot_auth.roles
+    iab_agentic_primitives.web_bot_auth.signer
+    iab_agentic_primitives.web_bot_auth.verifier
+forbidden_modules =
+    asyncio
+    concurrent
+    threading
+allow_indirect_imports = True
+
+[importlinter:contract:wba-conformance-public-only]
+name = conformance reaches the seams only through the public signers and verifiers
+type = forbidden
+source_modules =
+    iab_agentic_primitives.web_bot_auth.conformance
+forbidden_modules =
+    iab_agentic_primitives.web_bot_auth._sig
+    iab_agentic_primitives.web_bot_auth._wire
+allow_indirect_imports = True
+
+[importlinter:contract:wba-unchecked-only-in-conformance]
+name = only conformance signs raw, through _unchecked; no production module can
+type = forbidden
+source_modules =
+    iab_agentic_primitives.web_bot_auth.asgi
+    iab_agentic_primitives.web_bot_auth.httpx
+    iab_agentic_primitives.web_bot_auth.testing
+    iab_agentic_primitives.web_bot_auth.keyfile
+    iab_agentic_primitives.web_bot_auth.sync
+    iab_agentic_primitives.web_bot_auth.roles
+    iab_agentic_primitives.web_bot_auth.verifier
+    iab_agentic_primitives.web_bot_auth.signer
+    iab_agentic_primitives.web_bot_auth.resolver
+    iab_agentic_primitives.web_bot_auth.fetcher
+    iab_agentic_primitives.web_bot_auth.ports
+    iab_agentic_primitives.web_bot_auth.replay
+    iab_agentic_primitives.web_bot_auth.directory
+    iab_agentic_primitives.web_bot_auth.presentation
+    iab_agentic_primitives.web_bot_auth.rules
+    iab_agentic_primitives.web_bot_auth._sig
+    iab_agentic_primitives.web_bot_auth._wire
+    iab_agentic_primitives.web_bot_auth.message
+    iab_agentic_primitives.web_bot_auth.keys
+    iab_agentic_primitives.web_bot_auth.values
+    iab_agentic_primitives.web_bot_auth.errors
+    iab_agentic_primitives.web_bot_auth.extra
+forbidden_modules =
+    iab_agentic_primitives.web_bot_auth._unchecked
+allow_indirect_imports = False
+
+# The layer order, top to bottom. Every module has a place (exhaustive), so a new
+# module must take one. sync sits below the edges because the httpx edge and the
+# façades run on its loop; roles holds the ports the edges take. resolver composes
+# the ports and builds the default fetcher, so the fetcher sits below it; the
+# verifiers see only the KeyResolver port. _sig sits above _wire: it verifies the
+# SignatureMember that _wire parses.
+[importlinter:contract:wba-layers]
+name = web_bot_auth layer order (edges > roles > resolution > directory > seams > values)
+type = layers
+containers = iab_agentic_primitives.web_bot_auth
+exhaustive = True
+layers =
+    conformance
+    asgi | httpx | testing | keyfile | _unchecked
+    sync
+    roles
+    verifier | signer
+    resolver
+    fetcher
+    ports | replay
+    directory
+    presentation
+    rules
+    _sig
+    _wire
+    message | keys
+    values
+    errors | extra
diff --git a/CHANGELOG.md b/CHANGELOG.md
index cbff7f4..1f626a8 100644
--- a/CHANGELOG.md
+++ b/CHANGELOG.md
@@ -6,6 +6,28 @@ major version bump.
 
 ## [Unreleased]
 
+### Changed
+
+- The package requires Python 3.12 or later, and CI runs on 3.12. Before
+  3.12, pydantic refuses the `typing.TypedDict` types that the Web Bot Auth
+  conformance documents validate, so the 3.11 floor didn't hold.
+
+### Added
+
+- `iab_agentic_primitives.web_bot_auth`, the OpenProposal 3.0 § 2.8 Web Bot
+  Auth profile, behind the new `wba` extra: `RequestSigner` and
+  `ResponseSigner`, `RequestVerifier` and `ResponseVerifier` with typed
+  credentials, the signed key directory and its resolver, ASGI and httpx
+  edges, a sync façade, and the `Refusal` vocabulary. Its conformance vectors
+  ship as package data, with a runner, a typed adapter protocol
+  (`conformance/PROTOCOL.md`), and a Node harness that grades it against
+  Cloudflare's `web-bot-auth` library rule by rule. `make quality` runs its
+  gates; WEB_BOT_AUTH.md states the rules and the API.
+- The package ships a `py.typed` marker (PEP 561), so a type checker reads
+  its inline annotations instead of reporting `import-untyped`. The marker
+  covers the whole package, the existing modules as well as
+  `iab_agentic_primitives.web_bot_auth`.
+
 ## [0.5.1] - 2026-08-10
 
 First tagged release published on GitHub.
diff --git a/Makefile b/Makefile
new file mode 100644
index 0000000..e1efb38
--- /dev/null
+++ b/Makefile
@@ -0,0 +1,83 @@
+# Quality gates for the Web Bot Auth module.
+#
+# `make quality` runs every gate in order and stops at the first failure:
+# the ruff format check, the ruff lint (ruff-wba.toml, mccabe 10), the seam
+# boundary, the structural rules, the import contracts, mypy strict, and the
+# behavior suite with its branch-coverage floor. The upstream
+# commands in README.md (`uv run pytest`, `uv run ruff check .`) are
+# unchanged; these gates are scoped to the web_bot_auth paths so they never
+# fail on upstream modules.
+#
+# The interop tests drive Cloudflare's library through Node. pytest deselects
+# them by default (pyproject.toml), and `make interop` runs them.
+
+WBA_SRC := src/iab_agentic_primitives/web_bot_auth
+WBA_TESTS := tests/web_bot_auth
+WBA_PATHS := $(WBA_SRC) $(WBA_TESTS)
+WBA_INTEROP := $(WBA_TESTS)/interop
+
+# The branch-coverage floor for the module, measured over the WBA suite.
+WBA_COV_FLOOR := 94
+
+.PHONY: quality lint format-check lint-wba boundary guards imports typecheck
+.PHONY: test test-wba interop interop-deps
+
+# The stages run in sequence even under `make -j`.
+quality:
+	$(MAKE) format-check
+	$(MAKE) lint-wba
+	$(MAKE) boundary
+	$(MAKE) guards
+	$(MAKE) imports
+	$(MAKE) typecheck
+	$(MAKE) test-wba
+
+lint:
+	$(MAKE) format-check
+	$(MAKE) lint-wba
+	$(MAKE) boundary
+
+format-check:
+	uv run ruff format --check $(WBA_PATHS)
+
+lint-wba:
+	uv run ruff check --config ruff-wba.toml $(WBA_PATHS)
+
+# Only the wire seams import the RFC 9421 and Structured Fields libraries, and
+# only the fetcher, the httpx edge, and testing import httpx.
+boundary:
+	uv run ruff check --config ruff-wba-boundary.toml $(WBA_SRC)
+
+# Every structural rule is `severity: error`, so any finding fails the scan.
+guards:
+	uv run ast-grep scan --config sgconfig.yml --report-style short
+
+# The layer order and the I/O and seam contracts.
+imports:
+	uv run lint-imports --config .importlinter
+
+# mypy strict on the whole module and the whole suite, with the settings in
+# pyproject.toml. Imported modules are analyzed but not reported.
+typecheck:
+	uv run mypy --follow-imports=silent $(WBA_PATHS)
+
+# The WBA behavior suite with the branch-coverage floor.
+test-wba:
+	uv run pytest $(WBA_TESTS) -q \
+		--cov=iab_agentic_primitives.web_bot_auth --cov-branch \
+		--cov-fail-under=$(WBA_COV_FLOOR)
+
+# The whole repo, upstream tests included, as CI's test job runs it.
+test:
+	uv run pytest
+
+# The harness's pinned Cloudflare libraries. npm ci reruns only when the lock
+# file is newer than the installed tree.
+interop-deps: $(WBA_INTEROP)/node_modules/.package-lock.json
+
+$(WBA_INTEROP)/node_modules/.package-lock.json: $(WBA_INTEROP)/package-lock.json
+	npm ci --prefix $(WBA_INTEROP)
+
+# Interop with Cloudflare's web-bot-auth, the tests pytest deselects by default.
+interop: interop-deps
+	uv run pytest -m interop $(WBA_TESTS)/test_wba_interop.py -v
diff --git a/README.md b/README.md
index cfad164..c235941 100644
--- a/README.md
+++ b/README.md
@@ -28,6 +28,14 @@ implementation.**
   spec fixtures in CI (continuous integration) like any other
   implementation.
 
+The Web Bot Auth vectors are the one exception: they live in the package, in
+`src/iab_agentic_primitives/web_bot_auth/vectors/`, beside the adapter
+protocol they are graded with (`conformance/PROTOCOL.md`). The module is
+self-contained so it can be lifted into another repository, and an installed
+wheel carries everything its conformance CLI reads. Regenerate them with
+`python -m iab_agentic_primitives.web_bot_auth.conformance --regenerate`, the
+same flag as the package's own conformance CLI.
+
 ## Package layout
 
 | Module | Role |
@@ -37,6 +45,7 @@ implementation.**
 | `iab_agentic_primitives.state` | Canonical lifecycle state machines (one state vocabulary per exchanged primitive) |
 | `iab_agentic_primitives.events` | Shared event types crossing the buyer/seller boundary |
 | `iab_agentic_primitives.conformance` | Schema validators, golden vectors, standards checklist |
+| `iab_agentic_primitives.web_bot_auth` | The OpenProposal § 2.8 Web Bot Auth profile: signed requests and responses, the signed key directory, verification, conformance vectors, and an interop harness. Needs the `wba` extra; see [WEB_BOT_AUTH.md](WEB_BOT_AUTH.md) |
 
 The subpackages are scaffolded but intentionally empty of domain models:
 primitive and protocol definitions land in subsequent work items.
@@ -56,11 +65,12 @@ This library follows semantic versioning (semver):
 
 ## Development
 
-Requires Python >= 3.11 and [uv](https://docs.astral.sh/uv/).
+Requires Python >= 3.12 and [uv](https://docs.astral.sh/uv/).
 
 ```bash
 uv run pytest        # tests
 uv run ruff check .  # lint
+make quality         # Web Bot Auth gates
 ```
 
 The only runtime dependency is `pydantic>=2`.
diff --git a/WEB_BOT_AUTH.md b/WEB_BOT_AUTH.md
new file mode 100644
index 0000000..099a0f3
--- /dev/null
+++ b/WEB_BOT_AUTH.md
@@ -0,0 +1,1074 @@
+# Web Bot Auth profile
+
+`iab_agentic_primitives.web_bot_auth` implements the Web Bot Auth (WBA) profile
+that OpenProposal 3.0 § 2.8 defines for agent-to-agent HTTP traffic. With it, a
+buyer agent signs each request it sends, a seller agent verifies the signature
+and learns which origin sent the request, and the seller signs each response and
+binds it to the request it answers. Neither party needs the other's key in
+advance: each one publishes its keys in a signed key directory at its own
+origin, and the verifier fetches that directory.
+
+The module confirms a signature and returns the verified origin. It doesn't
+decide who the caller is in your system. Your identity boundary maps
+`VerifiedRequest.origin` to the principal in your own records, the same way it
+maps a bearer token.
+
+The module is self-contained. It imports nothing else from
+`iab_agentic_primitives`, and its dependencies are the `wba` extra:
+
+```bash
+pip install 'iab-agentic-primitives[wba]'
+```
+
+The module uses existing libraries for everything except the profile's rules:
+
+| Library | Use |
+| :--- | :--- |
+| `http-message-signatures==3.0.0` | RFC 9421 signature bases, Ed25519 signing and verification, the `;key` and `;req` component parameters, and RFC 9530 `Content-Digest` |
+| `http-sf` | RFC 8941 Structured Fields for `Signature`, `Signature-Input`, and `Signature-Agent`, with duplicate keys refused |
+| `joserfc` | JWK import and export, and RFC 7638 thumbprints for Ed25519 (RFC 8037) |
+| `idna` | IDNA-2008 host canonicalization for the origin rule |
+| `cryptography` | Ed25519 keys |
+| `httpx` | Directory fetches, through a client you can inject |
+
+The module overrides one hook of `http-message-signatures`, the verifier's
+time-window check, so the profile can check the window against an injected
+clock. `tests/web_bot_auth/test_wba_library_contract.py` pins the library
+behavior the module relies on, through the module's own signers and
+verifiers. The ASGI helpers are plain ASGI, so they need no web framework.
+
+## Profile rules
+
+The profile selects options that WBA and RFC 9421 already define. It adds no
+header, tag, key field, or error code.
+
+| Rule | Profile choice |
+| :--- | :--- |
+| Identity | An origin `https://<host>`: a canonical host with no port, and no path, query, fragment, or userinfo. A canonical host is lowercase IDNA-2008 A-labels whose last label isn't a number, or an IP literal in its compressed form (IPv6 in brackets, with no zone). One agent per origin. |
+| `Signature-Agent` value | A signer sends its key directory URL, `https://<host>/.well-known/http-message-signatures-directory`, with no member parameters. A verifier accepts exactly that URL or exactly the bare origin `https://<host>` (the draft -00 form), with the same host rules, compares without normalizing, and refuses any other value with `403`. Both forms name the origin `https://<host>`. A member that carries parameters is ignored. |
+| Keys | The origin's key directory, `GET https://<origin>/.well-known/http-message-signatures-directory`, a JWK Set served as `application/http-message-signatures-directory+json`. Signing keys are Ed25519 (`kty` `OKP`, `crv` `Ed25519`), and each `kid` is the key's RFC 7638 thumbprint. The verifier looks a key up by the pair (origin, `keyid`), never by `keyid` alone. |
+| Directory signatures | The directory response is signed once per Ed25519 key, covering `"@authority";req` and `content-digest`, with `created`, `expires`, `keyid`, `tag="http-message-signatures-directory"`, and, when present, `alg="ed25519"`. Signers send `alg`; a verifier accepts a signature without it, as draft -01 Appendix E.2.3 shows. The same 60 s clock skew as for requests applies to `created`, so a `created` up to 60 s in the future is accepted. It doesn't apply to `expires`: a directory signature verifies until its `expires` and not one second after. Every Ed25519 key signs. Keys of other types, and their signatures, are ignored. The server signs for its own configured authority, never for the `Host` a client sends. |
+| Fetches | The verifier fetches exactly `https://<host>/.well-known/http-message-signatures-directory` with `Accept-Encoding: identity`. `https` only, no redirects (any `3xx` is refused), status `200` only, the directory media type, no `Content-Encoding` other than `identity`, a 256 KiB cap on the raw body read as a stream, a `Content-Digest` with `sha-256`, a UTF-8 JSON body, at most 16 keys, and 5 s to connect and 10 s in total. |
+| Cache | A fetched directory is fresh for 300 s and valid while the current time is at or before the earliest `expires` among its signatures, the same rule the directory check applies. While it's fresh, it answers every `keyid` without a fetch, so an unknown `keyid` never triggers one. A stale directory is fetched again, and a directory that resolves replaces the entry, with or without the key. A failed fetch doesn't evict a valid entry, and the origin isn't fetched again for 60 s. Both caches are bounded. |
+| One signature | Exactly one `Signature-Input` member with `tag="web-bot-auth"` and exactly one `Signature-Agent` member, keyed to that member's label. A repeat of that member's label is refused with `403`. The verifier doesn't read members with other tags, nor their repeats, but every member must be well formed. |
+| Request components | `@method`, `@target-uri`, `@authority`, and `"signature-agent";key=<label>`. With a body, also `content-type` and `content-digest`, which must carry `sha-256`, and the verifier checks the digest against the body bytes. The verifier rebuilds `@target-uri` and `@authority` from its own configured origin, never from `Host`, and can refuse a URL for any authority but its own. |
+| Target URI | `@target-uri` is the URL as it travels on the wire, and `@authority` is its authority: see "The target URI". |
+| Request parameters | `created`, `expires` (at most 300 s after `created`), `nonce` (64 random bytes, as unpadded base64url or padded base64), `keyid`, `alg="ed25519"`, and `tag="web-bot-auth"`. The verifier allows 60 s of clock skew. |
+| Response components | `@status`, `"@method";req`, `"@target-uri";req`, and `"signature-agent";key=<label>`. With a body, also `content-type` and `content-digest`. When the request carried a `web-bot-auth` signature, also `"signature";req;key=<request label>`, which binds the response to that exact request. A response to `HEAD` has no body to cover, whatever the application produced, since the server doesn't send one: signer and verifier read the content through the one rule, `RESPONSE.content`. |
+| Response parameters | `created`, `expires` (at most 300 s after `created`), `keyid`, `alg="ed25519"`, and `tag="web-bot-auth"`. No nonce: the binding gives freshness. |
+| Replay | The verifier records each nonce per origin and refuses one it has seen within the signature's lifetime. |
+| Failures | `400` when a signature field doesn't parse, `403` when verification or a profile rule fails, `429` for a replayed nonce, and `503` when the verifier can't record a nonce. |
+
+### The target URI
+
+`@target-uri` is the request URL as it travels on the wire: the URL an HTTP
+client sends and a server receives. It is the WHATWG URL serialization, which
+httpx and `fetch` send and Cloudflare's `web-bot-auth` signs, normalized per
+RFC 3986 section 6.2.2:
+
+- The scheme and host are lowercase, a host name in IDNA A-labels and an IP
+  literal in compressed form, and a default port (`:443`, `:80`) is dropped.
+- Dot segments are removed, `%2e` included, and an empty path is `/`.
+- The characters WHATWG percent-encodes are percent-encoded: controls, space,
+  non-ASCII (as UTF-8), `"`, `<`, and `>`, plus `` ` ``, `{`, and `}` in the
+  path and `'` in the query. Every other character stays as written, so
+  `?ids[]=1`, `?f=a|b`, `?q={json}`, and `?q=a^b` are signed as they are sent.
+  An existing escape, such as `%20` or even `%zz`, is never changed.
+- Userinfo and the fragment, which never go on the wire, are dropped, and so
+  is an empty query: a server can't tell `/p?` from `/p`.
+
+`@authority` is the authority of the same URL: the host and a port other
+than the default. `message.target_uri(url)` is this rule, and
+`values.TargetURI` holds its parts. The signers sign it, the verifiers
+recompute it, and the server's edge rebuilds it from the bytes it received,
+so a signer can't sign a URL that a verifier or an edge reads differently.
+`RequestSigner.sign` returns the request at that URL: send it to that URL
+with a client that sends it as given, as httpx and `fetch` do. The library
+hands http-message-signatures the parsed parts through its
+`component_resolver_class` extension point, since the library's own parser
+accepts only the strict RFC 3986 grammar, which refuses the characters
+clients send raw. Vectors `positive/005` to `positive/012` and the
+target-URI cases of the interop harness grade the rule.
+
+### Verification procedure
+
+This is the one statement of the procedure. `verifier.py` implements it, one
+function per step, and names each step it implements;
+`tests/web_bot_auth/test_wba_docs.py` checks that the names agree.
+The procedure applies to a signed message, one that carries
+`Signature-Input`. `is_signed(headers)` is the one test of that, and both
+edges decide with it, before any body is read: a message without
+`Signature-Input`, such as one with only another scheme's `Signature`, is
+unsigned, and its `Signature` is never parsed. Asked to verify an unsigned
+message, a verifier refuses it `403` `signature-missing`.
+`RequestVerifier.verify` runs these steps in order:
+
+1. **Parse the fields.** Parse `Signature`, `Signature-Input`, and
+   `Signature-Agent` as Structured Field Dictionaries, once. Any parse
+   failure, a repeated parameter, a `Signature-Input` member that isn't an
+   Inner List of Strings, a parameter of another type than RFC 9421 section
+   2.3 gives it (`created` and `expires` Integers; `keyid`, `alg`, `nonce`,
+   and `tag` Strings), or a `Signature` member that isn't a Byte Sequence is
+   `400`. Every member is checked, whatever its tag, before any step-2 rule
+   runs.
+2. **Select the signature.** Select the one `web-bot-auth` member and the
+   `Signature-Agent` member with the same label, and read the origin the
+   member names. More than one of either, a repeat of the selected label, an
+   absent member, or a member the signature doesn't cover is `403`. A label
+   repeated on another signer's member is not this signature's concern. A
+   member with parameters is ignored (`403` when it is the covered one), and
+   a value that isn't the key URL or the bare origin is `403`. Both forms
+   give the origin `https://<host>`.
+3. **Check the authority.** The request URL names the verifier's own
+   `identity.request_authority`, the authority of its `base_url`, which the
+   edges rebuild each request URL on: a URL for another authority is `403`
+   `authority`.
+4. **Check the parameters.** `keyid`, `alg`, the window, the lifetime, and
+   the nonce rule: `403`.
+5. **Check the components.** The signature covers every component the rules
+   require: `403` `components`.
+6. **Resolve the key.** Refuse a `keyid` the verifier's `KeyPolicy` refuses:
+   always the published test keys (`rules.TEST_KEY_IDS`), plus any
+   `KeyPolicy(reject_keyids=...)` lists; only a conformance run accepts the
+   test keys, with `keys=CONFORMANCE_KEYS` (`403` `rejected-key`), then
+   resolve the key by (origin, `keyid`): `403` when the directory doesn't
+   hold it, or with the directory's own refusal when its fetch or check fails.
+7. **Verify the signature.** Check a covered `Content-Digest` against the
+   body, then verify the signature: `403`. The credential's `created`,
+   `expires`, and `nonce` are the parameters the library authenticated.
+8. **Check the nonce.** Check and record the nonce for the origin: `429` when
+   seen before, and `503` when the nonce store can't record it.
+
+`ResponseVerifier.verify` runs the same steps under the response rules, with
+no authority or nonce step. Its components include the binding to the signed
+request it answers, whose absence is `response-not-bound`. After them it runs
+one more step, **Check the signer.** The response is signed by the origin
+`expected_origin` names (`origin-mismatch`): by default `SAME_ORIGIN`, the
+identity of the host the request went to, which `Origin.of_url` maps from
+the request URL through IDNA, so a request to `https://bücher.example`
+expects `https://xn--bcher-kva.example`; an `Origin`; or `None` for any
+identity. A response carries no nonce.
+
+A failure raises `WebBotAuthError`, the refusal a verifier sends to the peer
+that sent the message. A client doesn't answer the server it called, so the
+httpx client reports what it found out about a response as a value instead
+(see "Call a seller with httpx"). Its `refusal` is a member of the
+`Refusal` enum, which carries the reason code, the status, and how the refusal
+is presented. `status` is `400`, `403`, `429`, or `503`; no other status can be
+expressed. `reason` is the machine string:
+
+| Status | `reason` values |
+| :--- | :--- |
+| `400` | `parse` |
+| `403` | `signature-missing`, `multiple-signatures`, `signature-agent-missing`, `multiple-signature-agents`, `signature-agent-not-covered`, `signature-agent-parameters`, `signature-agent-value`, `keyid`, `alg`, `window`, `lifetime`, `created-in-future`, `expired`, `nonce-missing`, `nonce-invalid`, `components`, `content-digest`, `signature-invalid`, `key-not-found`, `rejected-key`, `authority`, and the directory reasons (`directory-status`, `directory-encoding`, `directory-media-type`, `directory-unavailable`, `directory-too-large`, `directory-too-many-keys`, `directory-content-digest`, `directory-format`, `directory-kid`, `directory-no-usable-key`, `directory-signature-parse`, `directory-one-signature-per-key`, `directory-tag`, `directory-components`, `directory-window`, `directory-signature`). Responses add `response-not-bound` and `origin-mismatch`. |
+| `429` | `nonce-replayed` |
+| `503` | `nonce-store-unavailable` |
+
+`refusal_response(error, has_body=...)` returns the response that refuses a
+message, as an `Answer` (`status`, `headers`, `body`): the refusal's status, the JSON body
+`{"error": reason, "status": status}`, `Accept-Signature` on a `403` or `429` (the
+value that `accept_signature()` returns, so the signer can sign again), and
+`Retry-After: 1` on a `503`. The body never carries the error's detail, such as
+a directory fetch error or a nonce store's message, which could tell an
+unauthenticated peer about the verifier's network; the verifiers log it. `RequireSignatureMiddleware` sends it, and a
+framework route returns it, so every refusal looks the same on the wire.
+
+A mistake in configuration, such as a malformed origin, a lifetime out of
+range, a bound that isn't a whole number, or a string where an identity is
+expected, raises `ConfigurationError` (a `ValueError`) when the value, policy,
+signer, verifier, resolver, store, or middleware is made. So does a resolver
+used on a second event loop or after it is closed. It is never a refusal and
+never goes on the wire. Every configuration type checks itself when it is
+made, and the roles, the resolver, and the edges are fixed once made.
+
+## Modules
+
+Each module states its public names once, in a sorted `__all__`; the table
+lists them, and `tests/web_bot_auth/test_wba_docs.py` compares it with the
+code. A name that isn't in `__all__` is not part of the API.
+
+| Module | What it holds | `__all__` |
+| :--- | :--- | :--- |
+| `values` | identities, key ids, time, and where a directory lives | `DIRECTORY_MEDIA_TYPE`, `DIRECTORY_PATH`, `OMIT`, `Authority`, `Clock`, `KeyId`, `Omit`, `Origin`, `RequestAuthority`, `Seconds`, `ServerIdentity`, `TargetURI`, `UnixSeconds`, `authority_of`, `identifier_set`, `is_canonical_host`, `is_decimal`, `system_clock`, `whole_number` |
+| `rules` | the profile rules, stated once | `ALGORITHM`, `CACHE`, `CLOCK_SKEW`, `CONTENT_DIGEST`, `DIRECTORY`, `DIRECTORY_TAG`, `MAX_LIFETIME`, `MESSAGE_WINDOW`, `NONCE_BYTES`, `NONCE_RULE`, `REQUEST`, `RESPONSE`, `SIGNATURE_TAG`, `STREAMING`, `TEST_KEY_IDS`, `CacheRules`, `ComponentId`, `ComponentParam`, `Rules`, `SignatureParams`, `Stamp`, `Streaming`, `Window`, `accept_signature`, `component_id`, `signature_agent_component`, `validate_nonce`, `web_bot_auth_label` |
+| `errors` | the refusal vocabulary and the errors | `RETRY_AFTER`, `ConfigurationError`, `Refusal`, `SigningError`, `Status`, `WebBotAuthError` |
+| `presentation` | a refusal, and the other ASGI answers, as an HTTP response | `NO_KEYS_RETRY_AFTER`, `body_too_large_response`, `method_not_allowed_response`, `no_keys_response`, `refusal_response`, `unsignable_response` |
+| `keys` | Ed25519 keys and JWK thumbprints | `JWK`, `Ed25519Key`, `PrivateJwk`, `PublicJwk`, `public_jwk_of`, `public_key_from_jwk`, `thumbprint` |
+| `directory` | publishing and verifying the key directory, with no I/O | `DEFAULT_DIRECTORY_LIFETIME`, `DEFAULT_DIRECTORY_MAX_AGE`, `DEFAULT_LIMITS`, `DEFAULT_PUBLISH`, `MAX_DIRECTORY_BYTES`, `MAX_DIRECTORY_KEYS`, `DirectoryPublisher`, `DirectoryResponse`, `FetchLimits`, `KeyInput`, `KeySet`, `KeySource`, `PublishPolicy`, `VerifiedDirectory`, `build_directory`, `check_fetch_rules`, `current_keys`, `parse_jwk_set`, `publish_directory`, `verify_directory` |
+| `ports` | the resolution ports | `DirectoryFetcher`, `DirectoryStore`, `DirectoryStoreUnavailable`, `KeyResolver`, `ResolvedKey` |
+| `resolver` | directory resolution and its cache | `DEFAULT_CACHE`, `CachePolicy`, `DirectoryResolver`, `MemoryDirectoryStore`, `StaticKeyResolver` |
+| `fetcher` | the default directory fetcher, over httpx | `BlockedAddress`, `HttpxDirectoryFetcher`, `TLSConfig` |
+| `testing` | directories served from data, and the store contracts | `check_directory_store`, `check_nonce_store`, `directory_transport`, `served_resolver` |
+| `replay` | nonce stores | `MemoryNonceStore`, `NonceStore`, `NonceStoreUnavailable` |
+| `message` | the immutable message model | `Answer`, `HTTPRequest`, `HTTPResponse`, `HeaderLines`, `Headers`, `target_uri` |
+| `signer` | request and response signing | `RequestSigner`, `ResponseSigner`, `SignerConfig`, `generate_nonce` |
+| `verifier` | request and response verification, and the credentials | `CONFORMANCE_KEYS`, `DEFAULT_KEYS`, `SAME_ORIGIN`, `ExpectedOrigin`, `KeyPolicy`, `RequestVerifier`, `ResponseVerifier`, `VerifiedRequest`, `VerifiedResponse`, `is_signed` |
+| `roles` | the role ports the edges and façades take | `RequestConfirmer`, `RequestSigning`, `ResponseConfirmer`, `ResponseSigning` |
+| `httpx` | `WebBotAuth`, the httpx clients it builds, and what they found out | `EXTENSION`, `UNSIGNED`, `ClientOptions`, `Expect`, `ResponseNotVerified`, `Unsigned`, `Verification`, `VerificationFailed`, `WebBotAuth`, `sent_request`, `verification`, `verified_response` |
+| `keyfile` | a key kept in a `0600` file, safe on concurrent first boots | `load_or_create` |
+| `sync` | the event loop synchronous code verifies on, and the sync façades | `SyncRequestVerifier`, `SyncResponseVerifier`, `SyncRuntime` |
+| `asgi` | response signing, the directory route, and the opt-in verifier | `DEFAULT_REQUIRE`, `DEFAULT_SIGNING`, `MAX_BODY_BYTES`, `ASGIApp`, `DirectoryMiddleware`, `Message`, `OnUnsigned`, `Receive`, `RequirePolicy`, `RequireSignatureMiddleware`, `ResponseSigningMiddleware`, `Scope`, `Send`, `ServerEdge`, `SigningPolicy`, `request_url`, `verified_request` |
+| `extra` | the `wba` extra and its install check | `EXTRA_MODULES` |
+| `conformance` | the vectors, the runner, the adapters, and the generator | `PROTOCOL`, `VECTORS`, `Check`, `CommandAdapter`, `ConformanceReport`, `LibraryAdapter`, `keys_document`, `meets`, `published_key_ids`, `published_keys`, `run_conformance`, `scenarios_document`, `vector_operation`, `vectors` |
+
+The package root exports the roles, the credentials, the ports, the errors,
+the values, the message and directory types their signatures name, and the
+profile's constants. Helpers stay in their modules. Importing the root, or
+verifying with a `StaticKeyResolver`, never imports httpx. The root's
+`__all__`:
+
+```text
+ALGORITHM
+CLOCK_SKEW
+CONFORMANCE_KEYS
+DIRECTORY_MEDIA_TYPE
+DIRECTORY_PATH
+DIRECTORY_TAG
+EXTRA_MODULES
+MAX_LIFETIME
+SAME_ORIGIN
+SIGNATURE_TAG
+Answer
+Authority
+CachePolicy
+Clock
+ConfigurationError
+DirectoryFetcher
+DirectoryPublisher
+DirectoryResolver
+DirectoryResponse
+DirectoryStore
+DirectoryStoreUnavailable
+Ed25519Key
+ExpectedOrigin
+FetchLimits
+HTTPRequest
+HTTPResponse
+HeaderLines
+Headers
+KeyId
+KeyPolicy
+KeyResolver
+KeySet
+MemoryDirectoryStore
+MemoryNonceStore
+NonceStore
+NonceStoreUnavailable
+Origin
+PublishPolicy
+Refusal
+RequestAuthority
+RequestConfirmer
+RequestSigner
+RequestSigning
+RequestVerifier
+ResolvedKey
+ResponseConfirmer
+ResponseSigner
+ResponseSigning
+ResponseVerifier
+Seconds
+ServerIdentity
+SigningError
+StaticKeyResolver
+TargetURI
+UnixSeconds
+VerifiedDirectory
+VerifiedRequest
+VerifiedResponse
+WebBotAuthError
+accept_signature
+is_signed
+publish_directory
+refusal_response
+system_clock
+target_uri
+thumbprint
+verify_directory
+```
+
+## Sign requests
+
+Load or create your agent's key once, and sign each request as your origin:
+
+```python
+from iab_agentic_primitives.web_bot_auth import HTTPRequest, RequestSigner
+from iab_agentic_primitives.web_bot_auth.keyfile import load_or_create
+
+# Mode 0600, written atomically: workers that boot together share one key.
+key = load_or_create("/var/lib/buyer/wba-key.jwk")
+signer = RequestSigner.of(key, "https://buyer.example.com")
+
+body = b'{"entry": {...}, "writes": {...}}'
+request = HTTPRequest(
+    "POST",
+    "https://seller.example.com/proposals/prop_7/commit",
+    {"Content-Type": "application/json"},
+    body,
+)
+signed = signer.sign(request)
+# signed.headers is request.headers followed by Content-Digest, Signature-Agent,
+# Signature-Input, and Signature. The request itself is unchanged.
+```
+
+`RequestSigner.of(key, origin)` uses the default label (`sig1`), lifetime
+(300 s), and clock. For any other, build a `SignerConfig(key, origin,
+label=..., lifetime=..., clock=...)` and pass it to `RequestSigner(config)`;
+one config serves a `ResponseSigner` too. A signer signs what the profile
+requires and takes no parameter that departs from it.
+
+When you pass your own `Content-Digest`, the signer keeps it only if it matches
+the body and carries a `sha-256` member; otherwise it raises `SigningError` (a
+`ValueError`), so a signer never sends what a verifier under the profile
+refuses. A signer raises `SigningError` for every message it can't sign, such
+as a body without `Content-Type` or a URL that isn't absolute.
+
+Serve your directory so verifiers can find `key`. A `DirectoryPublisher`
+publishes your identity's keys, and with an ASGI app, `DirectoryMiddleware`
+serves it at the well-known path:
+
+```python
+from iab_agentic_primitives.web_bot_auth import DirectoryPublisher, ServerIdentity
+from iab_agentic_primitives.web_bot_auth.asgi import DirectoryMiddleware
+
+BUYER = ServerIdentity.from_config("https://buyer.example.com")
+app = DirectoryMiddleware(app, DirectoryPublisher(BUYER.origin, [key]))
+```
+
+The directory is signed for the identity's own authority, whatever `Host` the
+client sends and whatever port the server listens on: a verifier fetches
+`https://<host>/.well-known/http-message-signatures-directory`. A framework
+route answers the same with `await publisher.answer(now)`, an `Answer`.
+`publish_directory(origin, keys, now=..., policy=...)` is the one function
+that builds and signs a directory, and it publishes only what
+`verify_directory` accepts: no keys, more than 16, or a key listed twice (one
+keyfile in both rotation slots) raises `ConfigurationError`.
+
+To rotate a key:
+
+1. Publish the new key next to the old one.
+2. Wait before you sign with the new key, at least the directory's
+   `Cache-Control` `max-age` (`PublishPolicy(max_age=...)`, 300 s by default)
+   plus the verifiers' `CachePolicy.max_cache_age` (300 s by default). A CDN
+   can serve the old directory for `max-age`, and a verifier answers from its
+   cached copy for `max_cache_age`, so a request signed earlier with the new
+   key can be refused.
+3. Sign with the new key.
+4. Remove the old key after the last signatures made with it expire.
+
+Pass a callable, sync or async, instead of a list so the directory shows the
+current keys: the publisher reads it and signs the directory afresh on every
+request.
+
+```python
+app = DirectoryMiddleware(app, DirectoryPublisher(BUYER.origin, keystore.published_keys))
+```
+
+When the callable returns no keys, the directory answers `503`; when it
+returns keys `publish_directory` refuses, the answer raises
+`ConfigurationError`.
+`PublishPolicy(lifetime=..., max_age=...)` sets each signature's lifetime
+(86400 s by default, whole seconds from 1) and the response's `max-age`.
+
+## Verify requests in FastAPI
+
+Verify at the boundary where you resolve every credential, and map the verified
+origin to your own principal:
+
+```python
+from fastapi import Depends, FastAPI, Request
+from fastapi.responses import Response
+
+from iab_agentic_primitives.web_bot_auth import (
+    DirectoryPublisher,
+    DirectoryResolver,
+    HTTPRequest,
+    RequestVerifier,
+    ResponseSigner,
+    ServerIdentity,
+    VerifiedRequest,
+    WebBotAuthError,
+    refusal_response,
+)
+from iab_agentic_primitives.web_bot_auth.asgi import ResponseSigningMiddleware, ServerEdge
+from iab_agentic_primitives.web_bot_auth.fetcher import HttpxDirectoryFetcher
+from iab_agentic_primitives.web_bot_auth.keyfile import load_or_create
+
+SELLER = ServerIdentity.from_config("https://seller.example.com")
+key = load_or_create("/var/lib/seller/wba-key.jwk")
+verifier = RequestVerifier(
+    # See "Fetch directories through your own client".
+    DirectoryResolver(HttpxDirectoryFetcher(ssrf_guarded_client)),
+    identity=SELLER,  # refuse a request signed for another server
+    nonces=RedisNonceStore(redis),  # shared by every worker; MemoryNonceStore() serves one process
+)
+
+
+class Refused(Exception):
+    def __init__(self, error: WebBotAuthError, has_body: bool) -> None:
+        self.error, self.has_body = error, has_body
+
+
+async def signature(request: Request) -> VerifiedRequest:
+    body = await request.body()
+    url = EDGE.request_url(request.scope)  # the public URL, behind a TLS proxy
+    try:
+        return await verifier.verify(HTTPRequest(request.method, url, request.headers.items(), body))
+    except WebBotAuthError as e:
+        raise Refused(e, has_body=bool(body)) from e
+
+
+api = FastAPI()
+
+
+@api.exception_handler(Refused)
+async def refused(request: Request, exc: Refused) -> Response:
+    # The status, JSON body, Accept-Signature, and Retry-After, as the middleware sends them.
+    answer = refusal_response(exc.error, has_body=exc.has_body)
+    return Response(answer.body, status_code=answer.status, headers=dict(answer.headers.items()))
+
+
+@api.post("/proposals/{proposal_id}/commit")
+async def commit(proposal_id: str, verified: VerifiedRequest = Depends(signature)):
+    principal = lookup_principal(str(verified.origin))  # your records, not the library's
+    ...
+
+
+EDGE = ServerEdge(
+    SELLER,
+    signer=ResponseSigner.of(key, SELLER.origin),
+    publisher=DirectoryPublisher(SELLER.origin, [key]),  # also served at the well-known path
+    confirmer=verifier,  # checked: it verifies for SELLER's base URL
+)
+app = ResponseSigningMiddleware(api, EDGE)
+```
+
+The server's identity is a `ServerIdentity`, built once from configuration
+with `ServerIdentity.from_config(base_url)`. `base_url` is the server's public
+base URL, such as `https://seller.example.com` or
+`https://seller.example.com:8443`: a lowercase scheme, a canonical host, and a
+port only when it isn't the scheme's default, with no userinfo or path.
+Anything else raises `ConfigurationError`. The identity's `origin` is always
+`https://<host>`, so a server on `:8443` signs as `https://seller.example.com`.
+Its `request_authority` is the base URL's, and it is the only authority a
+request to the server may name: the edges rebuild every request URL on
+`base_url`, so one fact sets both what they rebuild and what the verifier
+accepts. A `ServerIdentity` checks itself when it is made. No helper reads the authority from the `Host` header:
+the `Host` a client sends is a claim, and covering `@authority` only protects
+a request or a directory when the server compares it with its own.
+
+A `ServerEdge(identity, signer=..., publisher=..., confirmer=...)` is the one
+owner of the server's identity at its edges. It checks, when it is made, that
+the signer signs as `identity.origin`, that the publisher is that origin's,
+that a publisher with a list of keys lists the signer's key (`signer.keyid`),
+and that a confirmer, when given, verifies for the same `ServerIdentity`, base
+URL included. A mismatch raises `ConfigurationError` at startup, rather than
+every peer refusing later.
+
+`asgi.request_url(identity, scope)` rebuilds a request's URL on
+`identity.base_url` from the path and query bytes the client sent, under the
+URL rule of "The target URI", so it is the URL `RequestSigner` signed. It
+needs only the `ServerIdentity`, so a server that verifies requests and
+signs nothing calls it with no edge, signer, or key.
+`edge.request_url(scope)` is the same rebuild on the edge's identity. A
+caller that verifies a response to `/p?#x` verifies it as the server rebuilt
+`/p`, and `WebBotAuth` sends the URL as signed. Both middlewares rebuild it
+the same way, so the request a server verifies and the request it binds its
+response to are one. An application that verifies at its own boundary
+passes that URL to its verifier: a verifier configured for another base URL
+then refuses the request, instead of the server answering with responses
+every peer refuses. Build the edge without a `confirmer` when the verifier
+is made later, such as in a lifespan, and give that verifier
+`identity=edge.identity`.
+
+`ResponseSigningMiddleware(app, edge)` signs each buffered response with
+`edge.signer` and binds it to the request, and serves `edge.publisher`'s
+directory at the well-known path, as `DirectoryMiddleware` does. `DirectoryMiddleware` alone serves a party
+that publishes keys but signs no responses. `SigningPolicy` holds the
+options: it passes the responses its `streaming` rule names through
+unsigned, since a stream can't be buffered to be signed. The rule is a
+`rules.Streaming`, `rules.STREAMING` (`text/event-stream` alone) by default,
+and the client takes the same type, so a seller and its buyers configure one
+value. A response it can't sign under the profile, such as a body
+without `Content-Type`, a second `http.response.start`, or a body over
+`max_body_bytes` (1 MiB by default, declared or streamed), becomes a `500`
+with error `response-unsignable`, and the middleware logs it, so a route never
+sends an unsigned answer by accident. The app's scope doesn't advertise
+`http.response.pathsend`, `http.response.zerocopy`, or
+`http.response.trailers`, so a file response is sent as a body and signed.
+
+If you prefer a middleware that verifies requests, wrap the app in the opt-in
+`RequireSignatureMiddleware(app, edge, policy=RequirePolicy(prefixes=("/proposals",)))`,
+and read the credential with `verified_request(request.scope)`. It verifies
+with the edge's `confirmer`, any `RequestConfirmer`, such as a
+`RequestVerifier` or your own wrapper around one; an edge without one raises
+`ConfigurationError`. Wrap it in `ResponseSigningMiddleware` with the same
+edge. It decides on an
+unsigned request, one without `Signature-Input` (`is_signed`), from its
+header before reading any body: refused `403` `signature-missing`, with
+`Accept-Signature`, with
+`RequirePolicy(on_unsigned="refuse")` (the default), passed on with no
+credential with `"pass"`. A signed request whose signature fails is refused in
+either mode. A body over `max_body_bytes` (1 MiB by default) is answered
+`413`. The directory path is always let through unsigned.
+
+The verifiers log each refusal at `INFO`, with the status, the reason, and the
+origin and keyid when known, and the resolver logs each failed directory fetch
+at `WARNING`, with the origin and the time until it is retried. No record
+carries a nonce or a body.
+
+### Share the nonce store across workers
+
+`MemoryNonceStore` holds nonces in one process. When several workers verify
+requests for one deployment, back `NonceStore` with shared storage. The method
+must record the pair and return `True` when it's new, atomically, and keep it
+for `ttl` seconds. When it can't record the pair, for example because the
+store is full or down, it raises `NonceStoreUnavailable`, and the verifier
+answers `503` with `nonce-store-unavailable` instead of `429`: the nonce isn't
+a replay, and a client that signs again would only be refused again. Any
+other error is a bug and propagates. `MemoryNonceStore` raises
+`NonceStoreUnavailable` when full. `testing.check_nonce_store(make)` checks a
+store against this contract.
+
+```python
+import redis.exceptions
+
+from iab_agentic_primitives.web_bot_auth import NonceStoreUnavailable, Origin, Seconds
+
+
+class RedisNonceStore:
+    def __init__(self, redis):
+        self.redis = redis
+
+    async def check_and_record(self, origin: Origin, nonce: str, ttl: Seconds) -> bool:
+        key = f"wba:nonce:{origin}:{nonce}"
+        try:
+            return bool(await self.redis.set(key, 1, nx=True, ex=max(1, ttl)))
+        except redis.exceptions.RedisError as e:
+            raise NonceStoreUnavailable(str(e)) from e
+```
+
+### Fetch directories through your own client
+
+`DirectoryResolver` composes two ports: a `DirectoryFetcher`, which fetches an
+origin's `DirectoryResponse`, and a `DirectoryStore`, which keeps plain data,
+each origin's `DirectoryResponse` and failure deadline, and decides nothing.
+`put(origin, response)` and `get(origin)` take and return the response's URL,
+status, field lines, body bytes, and `fetched_at`, so a store shared by
+several workers, such as Redis, serializes it with `response.document()`.
+The resolver owns the rules. It verifies a directory once, when it enters the
+process: from the fetcher, or as stored bytes it hasn't verified, such as a
+response another worker wrote. It holds each verified directory in memory by
+origin and answers from it while the store returns the response it was
+verified from, so a cache hit or an unknown `kid` costs no verification.
+Stored bytes are verified for the origin it asked for, at the response's
+`fetched_at`, and under its own `FetchLimits`; a response that doesn't verify
+is a cache miss, never a refusal. A directory answers only until its `expires`. The resolver's own
+`clock` (the system clock by default) stamps each fetch and judges the cache:
+a directory is fresh for `CachePolicy.max_cache_age` (300 s), and a failed
+fetch isn't retried for `CachePolicy.negative_ttl` (60 s). The time a verifier
+judges at decides only whether the directory has expired by then
+(`directory-window`); it never stamps or ages the cache. The defaults are
+`HttpxDirectoryFetcher` and `MemoryDirectoryStore`. Concurrent resolves of
+one origin share one fetch. Only a refusal counts as a failed fetch; any
+other error propagates and leaves no negative entry.
+`testing.check_directory_store(make)` checks a store against its contract.
+
+A store whose backend is down, such as Redis in an outage, raises
+`DirectoryStoreUnavailable` from the method that failed, and nothing else;
+any other error is a bug that propagates. The resolver reads a failed `get`
+or `failure_until` as nothing stored, so it fetches the directory afresh,
+and it logs a failed `put` or `record_failure` at `WARNING` and goes on, so
+the refusal of a failed fetch stays the refusal. An outage costs a fetch per
+resolve, never a `500`, and the store is used again once it answers.
+
+```python
+import json
+
+import redis.exceptions
+from iab_agentic_primitives.web_bot_auth import DirectoryStoreUnavailable
+
+
+class RedisDirectoryStore:
+    async def put(self, origin, response):
+        try:
+            await self.redis.set(f"wba:directory:{origin}", json.dumps(response.document()))
+        except redis.exceptions.RedisError as e:
+            raise DirectoryStoreUnavailable(str(e)) from e
+
+    ...  # get, record_failure, and failure_until wrap their calls the same way
+```
+
+A resolver belongs to the event loop it first resolves on, as its fetches in
+flight and its client's connections do. A resolve on another loop raises
+`ConfigurationError`, and so does one after `aclose()`. Synchronous code
+reaches a resolver through one `SyncRuntime`.
+
+`HttpxDirectoryFetcher` fetches through one `httpx.AsyncClient`. Pass your
+client to it; the fetcher never closes a client or a transport it was given.
+Without one, it builds one client, once, and the resolver that built it closes
+it in `aclose()` or at the end of `async with`. The profile's fetch rules apply
+on any client, and a redirect is never followed. Address policy is left to the
+client: a production verifier injects a client that guards against server-side
+request forgery, for example by checking the resolved address and connecting
+only to the address it checked. A guarding transport raises
+`fetcher.BlockedAddress`, an `httpx.TransportError`, for an address it
+refuses; the fetch is then refused with `directory-unavailable` and held back
+like any failed fetch.
+
+To trust a test CA, inject a client with `verify` set, or pass a `TLSConfig`
+with `extra_ca` (added to the system trust store) or `ca_bundle` (in place of
+it) for the client the fetcher builds. TLS options together with an injected
+client raise `ConfigurationError`:
+
+```python
+import httpx
+
+from iab_agentic_primitives.web_bot_auth import CachePolicy, DirectoryResolver
+from iab_agentic_primitives.web_bot_auth.fetcher import HttpxDirectoryFetcher, TLSConfig
+
+resolver = DirectoryResolver(
+    HttpxDirectoryFetcher(httpx.AsyncClient(verify="/certs/test-ca.pem")),
+    cache=CachePolicy(max_cache_age=60),
+)
+async with DirectoryResolver(HttpxDirectoryFetcher(tls=TLSConfig(extra_ca="/certs/test-ca.pem"))) as resolver:
+    ...
+```
+
+In tests, serve signed directories from data with
+`testing.served_resolver({origin: answer}, clock=...)`, or
+`HttpxDirectoryFetcher(transport=directory_transport({...}))`. Each streams
+the body, so the fetch runs the same bounded read as over the network.
+
+### Keep the directory you verified against
+
+OpenProposal § 4.1.2 asks a party to keep the bytes of the key directory it
+verified against. `VerifiedRequest.directory` is that directory, when the
+resolver provides it, as `DirectoryResolver` does. Its `origin` is the
+identity it belongs to, and its `evidence` is the `DirectoryResponse` the keys
+were verified from: `url` (always `origin.directory_url`), `status`,
+`headers`, `body` (the exact bytes verified, as read off the wire under the
+256 KiB cap), and `fetched_at`. `evidence.document()` returns them as
+JSON-ready data, with the body both as text and, losslessly, as
+`body_base64`. `verify_directory` verifies a stored response again later, and
+`StaticKeyResolver` takes the keys it returns. A verified directory or
+credential can't be copied or pickled: verify the evidence again.
+
+```python
+verified = await verifier.verify(HTTPRequest(method, url, headers, body))
+store_evidence(str(verified.origin), verified.keyid, verified.directory.evidence.document())
+
+stored = DirectoryResponse(origin.directory_url, status, headers, body, fetched_at)
+directory = verify_directory(stored, origin, fetched_at)
+offline = StaticKeyResolver({origin: directory.keys})
+```
+
+## Call a seller with httpx
+
+`WebBotAuth` is how a client signs and verifies, and the library builds the
+client from it: `auth.async_client()` returns an `httpx.AsyncClient`, and
+`auth.client()` an `httpx.Client`. Signing happens in the client's one
+transport, which wraps the transport you pass (`httpx.AsyncHTTPTransport()`
+by default). It signs each request on the wire for its own URL and, with a
+`ResponseVerifier`, verifies the signed response to it and its binding to the
+exact request sent. The client always returns the response, with what it
+found out stored in it: `verification(response)` reads a `VerifiedResponse`,
+`Unsigned`, or `VerificationFailed` (a `reason`, a `Refusal` member, and a
+`detail`), `verified_response(response)` reads the `VerifiedResponse` alone,
+and `sent_request(response)` returns the request as signed and sent, an
+`HTTPRequest`, which the response is bound to. `response.request` is the
+request before signing.
+
+```python
+from iab_agentic_primitives.web_bot_auth import DirectoryResolver, RequestSigner, ResponseVerifier
+from iab_agentic_primitives.web_bot_auth.httpx import WebBotAuth, sent_request, verified_response
+
+async with DirectoryResolver() as resolver:
+    auth = WebBotAuth(RequestSigner.of(key, "https://buyer.example.com"), ResponseVerifier(resolver))
+    async with auth.async_client(timeout=10) as client:
+        response = await client.post("https://seller.example.com/proposals/prop_7/commit", json=commit)
+        verified = verified_response(response)  # a VerifiedResponse
+        str(verified.origin), verified.origin.host  # "https://seller.example.com", "seller.example.com"
+        sent = sent_request(response)  # the signed request, to keep beside the response
+```
+
+The client takes the httpx settings `ClientOptions` lists, such as
+`headers`, `timeout`, `base_url`, `auth` (for a bearer token, say), and
+`follow_redirects`. Connection settings, such as TLS, a proxy, or HTTP/2,
+go on the transport you pass. Any other setting, such as `mounts` or
+`proxy`, would route requests around the signing transport, so it raises
+`ConfigurationError`, and the client reads no proxy from the environment, for
+the same reason. `WebBotAuth` is not an
+`httpx.Auth`: `httpx.AsyncClient(auth=WebBotAuth(...))` raises `TypeError`.
+
+The client decides from the response's header lines whether it is signed
+(`is_signed`). It returns an unsigned response unread, so an event stream
+arrives as the seller sends it, and reads and verifies a signed one. A
+response must be signed by `https://<host>` of the host each request went
+to, whatever the URL's scheme and port, which `Origin.of_url` maps through
+IDNA (`expect="same-origin"`, the `ResponseVerifier`'s own default).
+`expect=Origin.parse(...)` names another identity, and `expect=None` accepts
+any.
+
+By default (`require_signed_response`), a `2xx` that isn't verified, unsigned
+or failed, raises `ResponseNotVerified`. Its `response` is the response, body
+read, and its `verification` says why, so a commit the seller executed is
+never lost, only unverified. An unsigned response of a media type the
+client's `streaming` rule names, which a server streams unsigned, is let
+through: `rules.STREAMING` (`text/event-stream`) by default. A seller that
+also streams NDJSON configures
+`SigningPolicy(streaming=Streaming(("text/event-stream", "application/x-ndjson")))`,
+and its buyers pass the same `Streaming` as `WebBotAuth(..., streaming=...)`.
+Every response that isn't a `2xx` is let through too: an unsigned `403`, `429`, or `503` from a verifier in front of the
+seller, the server's own `500` `response-unsignable`, a redirect, or a
+proxy's `502` reaches you with its own status, `Retry-After`, and body, and
+`verification()` says `Unsigned`. With `require_signed_response=False`, no
+response raises. The settings are fixed when the `WebBotAuth` is made.
+
+Each wire hop is signed for its own URL, so a signature never reaches
+another URI. A redirect comes back as it is, with `follow_redirects=False`
+(httpx's default), and `response.next_request` carries no signature;
+`await client.send(response.next_request)` signs it for its new URL. With
+`follow_redirects=True`, the client signs each redirected request for its
+new URL as it sends it, and verifies each hop's response for the host that
+hop went to. Following a `307` or `308` sends the body to the new URL too, as
+httpx does; leave redirects off to decide on each one.
+
+For a call that authenticates another way, such as a bearer token, build the
+configuration with `WebBotAuth.verify_only(response_verifier)`. Its client
+sends the request unsigned and still verifies the signed response, which
+needs no binding because the request carried no signature.
+`verified_response(response)` returns it as before, with `bound` set to
+`False`. When it verifies responses, the client sends `Accept-Encoding:
+identity`, because `Content-Digest` covers the content as sent.
+
+`WebBotAuth` takes any `RequestSigning` and `ResponseConfirmer`. A
+synchronous client verifies on a `SyncRuntime` you own, passed as
+`runtime=`; without one, `auth.client()` raises `ConfigurationError`. With a
+runtime, async clients verify on it too, so one configuration serves an
+`httpx.Client` and an `httpx.AsyncClient` alike. It starts no thread, and
+each client closes the transport it wraps:
+
+```python
+from iab_agentic_primitives.web_bot_auth.sync import SyncRuntime
+
+resolver = DirectoryResolver()
+with SyncRuntime(resolver) as runtime:  # closes the resolver on its own loop
+    auth = WebBotAuth(signer, ResponseVerifier(resolver), runtime=runtime)
+    with auth.client() as client:
+        response = client.post(url, json=commit)
+```
+
+### Verify from synchronous code
+
+The verifiers are async, and a resolver belongs to one event loop. For
+synchronous code, create one `SyncRuntime` where you create the resolver: it
+runs one event loop on its own thread, under `asyncio.Runner`, for its whole
+life. Wrap a verifier in a façade from
+`iab_agentic_primitives.web_bot_auth.sync` that runs on it:
+
+```python
+from iab_agentic_primitives.web_bot_auth.sync import SyncRequestVerifier, SyncRuntime
+
+with SyncRuntime(resolver) as runtime:
+    sync = SyncRequestVerifier(verifier, runtime=runtime)
+    verified = sync.verify(HTTPRequest(method, url, headers, body))
+```
+
+Every façade and auth that verifies through the same resolver takes the same
+runtime. `SyncResponseVerifier` does the same for a `ResponseVerifier`.
+Closing the runtime cancels the calls still running, which raise
+`ConfigurationError`, closes the resolver it owns, and stops the thread. A
+façade call made inside a running event loop raises `RuntimeError` instead of
+blocking that loop; await `verify()` there, or `runtime.run_async(...)` for a
+resolver the runtime owns.
+
+A runtime belongs to the process that made it. A forked child inherits the
+runtime but not its thread, so a call there raises `ConfigurationError` at
+once instead of waiting on a loop nothing runs. Under a pre-fork server, such
+as gunicorn with `--preload` or uWSGI without lazy apps, create the runtime
+and its resolver in each worker, for example in a post-fork hook.
+
+## Conformance vectors
+
+The vectors are package data in `web_bot_auth/vectors/`; their
+[README](src/iab_agentic_primitives/web_bot_auth/vectors/README.md) states the
+format. Three published test keys sign them, each derived from the seed
+`sha256("aamp-wba-test/<name>")`, at the fixed clock 2026-11-07T12:00:00Z.
+Request bodies are an OpenProposal `Commit` posted to
+`https://seller.example.com/proposals/prop_7/commit`, and the response body is its
+`CommitResult`.
+
+- To grade an implementation, run
+  `python -m iab_agentic_primitives.web_bot_auth.conformance run --adapter "<command>"`.
+  Without `--adapter`, the command grades this library. The adapter protocol is
+  `conformance/PROTOCOL.md`, which ships in the package.
+- To regenerate the vectors, run
+  `python -m iab_agentic_primitives.web_bot_auth.conformance --regenerate`, the
+  same flag as the repository's own conformance CLI. It writes the
+  generator's own files and deletes a vector it no longer produces; nothing
+  else is touched. `--check` names each file that differs from the
+  generator, is missing, or isn't generated, and exits 1 when there is one.
+
+The documents are typed (`conformance.models`) and read strictly: JSON
+booleans and integers, no undeclared member, identities as `Origin`. Each
+vector carries the one operation that grades it, ready to send to an adapter.
+An outcome is a pass or a refusal; a refusal names its `rule`, and its status
+is the rule's. `vectors/refusals.json`, generated from `Refusal`, is the shared
+vocabulary, and a result passes only with the expected rule. A profile
+message is signed by `RequestSigner`, `ResponseSigner`, or `publish_directory`.
+A vector or scenario that departs from the profile is signed raw by the
+conformance interpreter, through a private signer that only `conformance`
+imports.
+
+Each vector and scenario names a tier. Tier `wba` means Cloudflare's library,
+with no profile rules, already gives the expected outcome. Tier `profile` means
+the bare library gives the opposite outcome, so only the profile's rules decide
+it.
+
+## Interop with Cloudflare's library
+
+`tests/web_bot_auth/interop/` is a Node harness pinned to `web-bot-auth@0.2.0`,
+`http-message-sig@0.3.0`, and `structured-headers@2.0.3` from npm. It runs this
+library through the adapter protocol in `conformance/PROTOCOL.md`, and it
+records three verdicts for each message: this library's, Cloudflare's library with the profile's rules
+(`policy.mjs`), and Cloudflare's library as shipped. web-bot-auth 0.2.0 has no
+response verifier, so the harness verifies responses with `http-message-sig`.
+The harness hands Cloudflare's library each request URL as a native `Request`
+carries it, the WHATWG serialization without the fragment, which is what a
+Worker signs and verifies. For each target-URI case of `scenarios.json`, both
+sides sign a `GET` to the URL as written, and the other side verifies it.
+
+From the repository root:
+
+```bash
+make interop
+```
+
+It installs the harness's Node dependencies and runs the tests marked
+`interop`, which `uv run pytest` deselects by default; CI runs them in their
+own job. Once selected, they fail, rather than skip, when `node` or those
+dependencies are absent.
+
+All 128 checks pass. A refusal reads as its status and rule, from the shared
+vocabulary in `vectors/refusals.json`; the harness requires the Python and the
+Cloudflare + profile verdicts to match the expected status and rule. A `-` means
+the check has no verdict from that side, for example a message the other side
+signed. `tests/web_bot_auth/test_wba_interop.py` compares this table with
+`run.mjs --json`.
+
+| Suite | Check | Tier | Python | Cloudflare + profile | Cloudflare bare |
+| :--- | :--- | :--- | :--- | :--- | :--- |
+| vectors | positive/001-single-signer-request | wba | pass | pass | pass |
+| vectors | positive/002-signed-directory-response | wba | pass | pass | pass |
+| vectors | positive/003-signed-response | wba | pass | pass | pass |
+| vectors | positive/004-origin-form-request | wba | pass | pass | pass |
+| vectors | positive/005-target-uri-array-brackets | wba | pass | pass | pass |
+| vectors | positive/006-target-uri-pipe | wba | pass | pass | pass |
+| vectors | positive/007-target-uri-braces | wba | pass | pass | pass |
+| vectors | positive/008-target-uri-caret | wba | pass | pass | pass |
+| vectors | positive/009-target-uri-escaped-space | wba | pass | pass | pass |
+| vectors | positive/010-target-uri-default-port | wba | pass | pass | pass |
+| vectors | positive/011-target-uri-mixed-case | wba | pass | pass | pass |
+| vectors | positive/012-target-uri-dot-segments | wba | pass | pass | pass |
+| vectors | negative/001-missing-nonce | profile | 403 nonce-missing | 403 nonce-missing | pass |
+| vectors | negative/002-replayed-nonce | profile | 429 nonce-replayed | 429 nonce-replayed | pass |
+| vectors | negative/003-signature-agent-not-covered | wba | 403 signature-agent-not-covered | 403 signature-agent-not-covered | 403 signature-agent-not-covered |
+| vectors | negative/004-key-not-in-named-directory | wba | 403 key-not-found | 403 key-not-found | 403 key-not-found |
+| vectors | negative/005-malformed-signature-agent | wba | 400 parse | 400 parse | 400 parse |
+| vectors | negative/006-two-signatures | wba | 403 multiple-signatures | 403 multiple-signatures | 403 signature-invalid |
+| vectors | negative/007-response-not-bound | profile | 403 response-not-bound | 403 response-not-bound | pass |
+| vectors | negative/008-key-not-in-named-directory-warm-cache | wba | 403 key-not-found | 403 key-not-found | 403 key-not-found |
+| live | Python signs the directory, Cloudflare verifies | wba | - | pass | pass |
+| live | Python signs the directory, body changed, both refuse | profile | 403 directory-content-digest | 403 directory-content-digest | pass |
+| live | Cloudflare signs the directory, Python verifies | - | pass | - | - |
+| live | Python signs POST, Cloudflare verifies | wba | - | pass | pass |
+| live | Python signs POST, URL changed, both refuse | wba | 403 signature-invalid | 403 signature-invalid | 403 signature-invalid |
+| live | Python signs POST, body changed, both refuse | profile | 403 content-digest | 403 content-digest | pass |
+| live | Cloudflare signs POST with the key URL, Python verifies | wba | pass | pass | pass |
+| live | Cloudflare signs POST with the bare origin, Python verifies | wba | pass | pass | pass |
+| live | Cloudflare signs POST, Python verifies it twice | - | 429 nonce-replayed | 429 nonce-replayed | - |
+| live | Cloudflare signs POST, URL changed, both refuse | wba | 403 signature-invalid | 403 signature-invalid | 403 signature-invalid |
+| live | Cloudflare signs POST, body changed, both refuse | profile | 403 content-digest | 403 content-digest | pass |
+| live | Python signs GET, Cloudflare verifies | wba | - | pass | pass |
+| live | Python signs GET, URL changed, both refuse | wba | 403 signature-invalid | 403 signature-invalid | 403 signature-invalid |
+| live | Cloudflare signs GET with the key URL, Python verifies | wba | pass | pass | pass |
+| live | Cloudflare signs GET with the bare origin, Python verifies | wba | pass | pass | pass |
+| live | Cloudflare signs GET, Python verifies it twice | - | 429 nonce-replayed | 429 nonce-replayed | - |
+| live | Cloudflare signs GET, URL changed, both refuse | wba | 403 signature-invalid | 403 signature-invalid | 403 signature-invalid |
+| live | U01 Array brackets in the query: its wire URL is the WHATWG serialization | - | - | pass | - |
+| live | Python signs U01 Array brackets in the query, Cloudflare verifies | wba | - | pass | pass |
+| live | Cloudflare signs U01 Array brackets in the query, Python verifies | wba | pass | pass | pass |
+| live | U02 A pipe in the query: its wire URL is the WHATWG serialization | - | - | pass | - |
+| live | Python signs U02 A pipe in the query, Cloudflare verifies | wba | - | pass | pass |
+| live | Cloudflare signs U02 A pipe in the query, Python verifies | wba | pass | pass | pass |
+| live | U03 Braces in the query: its wire URL is the WHATWG serialization | - | - | pass | - |
+| live | Python signs U03 Braces in the query, Cloudflare verifies | wba | - | pass | pass |
+| live | Cloudflare signs U03 Braces in the query, Python verifies | wba | pass | pass | pass |
+| live | U04 A caret in the query: its wire URL is the WHATWG serialization | - | - | pass | - |
+| live | Python signs U04 A caret in the query, Cloudflare verifies | wba | - | pass | pass |
+| live | Cloudflare signs U04 A caret in the query, Python verifies | wba | pass | pass | pass |
+| live | U05 An escaped space in the path: its wire URL is the WHATWG serialization | - | - | pass | - |
+| live | Python signs U05 An escaped space in the path, Cloudflare verifies | wba | - | pass | pass |
+| live | Cloudflare signs U05 An escaped space in the path, Python verifies | wba | pass | pass | pass |
+| live | U06 The default port: its wire URL is the WHATWG serialization | - | - | pass | - |
+| live | Python signs U06 The default port, Cloudflare verifies | wba | - | pass | pass |
+| live | Cloudflare signs U06 The default port, Python verifies | wba | pass | pass | pass |
+| live | U07 A mixed-case scheme and host: its wire URL is the WHATWG serialization | - | - | pass | - |
+| live | Python signs U07 A mixed-case scheme and host, Cloudflare verifies | wba | - | pass | pass |
+| live | Cloudflare signs U07 A mixed-case scheme and host, Python verifies | wba | pass | pass | pass |
+| live | U08 Dot segments in the path: its wire URL is the WHATWG serialization | - | - | pass | - |
+| live | Python signs U08 Dot segments in the path, Cloudflare verifies | wba | - | pass | pass |
+| live | Cloudflare signs U08 Dot segments in the path, Python verifies | wba | pass | pass | pass |
+| live | Python signs a response, Cloudflare verifies it and its binding | wba | - | pass | pass |
+| live | Python signs a response, presented with another request, both refuse | wba | 403 signature-invalid | 403 signature-invalid | 403 signature-invalid |
+| live | Cloudflare signs a response, Python verifies it and its binding | - | pass | pass | - |
+| live | Cloudflare signs a response, status changed, both refuse | wba | 403 signature-invalid | 403 signature-invalid | 403 signature-invalid |
+| scenarios | R00 Baseline | wba | pass | pass | pass |
+| scenarios | R01 Body changed after signing | profile | 403 content-digest | 403 content-digest | pass |
+| scenarios | R02 Covered header changed after signing | wba | 403 signature-invalid | 403 signature-invalid | 403 signature-invalid |
+| scenarios | R03 Expired | wba | 403 expired | 403 expired | 403 expired |
+| scenarios | R04 created 120 seconds in the future | wba | 403 created-in-future | 403 created-in-future | 403 created-in-future |
+| scenarios | R05 created 30 seconds in the future | profile | pass | pass | 403 created-in-future |
+| scenarios | R06 Lifetime of 3600 seconds | profile | 403 lifetime | 403 lifetime | pass |
+| scenarios | R07 Nonce of 32 bytes | wba | 403 nonce-invalid | 403 nonce-invalid | 403 nonce-invalid |
+| scenarios | R08 Nonce in canonical padded base64 | wba | pass | pass | pass |
+| scenarios | R09 Nonce in padded base64url | wba | 403 nonce-invalid | 403 nonce-invalid | 403 nonce-invalid |
+| scenarios | R10 No alg parameter | wba | 403 alg | 403 alg | 403 alg |
+| scenarios | R11 alg other than ed25519 | wba | 403 alg | 403 alg | 403 alg |
+| scenarios | R12 GET covering only @authority and the Signature-Agent member | profile | 403 components | 403 components | pass |
+| scenarios | R13 Body without content-digest covered | profile | 403 components | 403 components | pass |
+| scenarios | R13b Body without content-type covered | profile | 403 components | 403 components | pass |
+| scenarios | R14 tag other than web-bot-auth | wba | 403 signature-missing | 403 signature-missing | 403 signature-invalid |
+| scenarios | R23 Components in another order | wba | pass | pass | pass |
+| scenarios | R24 No nonce | profile | 403 nonce-missing | 403 nonce-missing | pass |
+| scenarios | R25 GET with the profile's components | wba | pass | pass | pass |
+| scenarios | R15 Bare-string Signature-Agent | profile | 400 parse | 400 parse | pass |
+| scenarios | R16 http:// key URL | profile | 403 signature-agent-value | 403 signature-agent-value | pass |
+| scenarios | R16b http:// origin | profile | 403 signature-agent-value | 403 signature-agent-value | pass |
+| scenarios | R17 Path other than the well-known path | profile | 403 signature-agent-value | 403 signature-agent-value | pass |
+| scenarios | R17a Well-known path with a trailing / | profile | 403 signature-agent-value | 403 signature-agent-value | pass |
+| scenarios | R17b Well-known path in another case | profile | 403 signature-agent-value | 403 signature-agent-value | pass |
+| scenarios | R17c Origin with a trailing / | profile | 403 signature-agent-value | 403 signature-agent-value | pass |
+| scenarios | R17d Uppercase host | profile | 403 signature-agent-value | 403 signature-agent-value | pass |
+| scenarios | R17e Explicit :443 | profile | 403 signature-agent-value | 403 signature-agent-value | pass |
+| scenarios | R17f Other port | profile | 403 signature-agent-value | 403 signature-agent-value | pass |
+| scenarios | R17g Query | profile | 403 signature-agent-value | 403 signature-agent-value | pass |
+| scenarios | R17h Fragment | profile | 403 signature-agent-value | 403 signature-agent-value | pass |
+| scenarios | R17i Userinfo | profile | 403 signature-agent-value | 403 signature-agent-value | pass |
+| scenarios | R17j Origin with a query | profile | 403 signature-agent-value | 403 signature-agent-value | pass |
+| scenarios | R18 Member with type=jwks_uri | profile | 403 signature-agent-parameters | 403 signature-agent-parameters | pass |
+| scenarios | R18c Origin member with type=directory as a Token | profile | 403 signature-agent-parameters | 403 signature-agent-parameters | pass |
+| scenarios | R18d Key URL member with type="directory" as a String | profile | 403 signature-agent-parameters | 403 signature-agent-parameters | pass |
+| scenarios | R18e Bare origin, the draft -00 form | wba | pass | pass | pass |
+| scenarios | R19 Signature-Agent member keyed differently from the label | profile | 403 signature-agent-missing | 403 signature-agent-missing | pass |
+| scenarios | R21 Two Signature-Agent members, one signature | profile | 403 multiple-signature-agents | 403 multiple-signature-agents | pass |
+| scenarios | R22 Label other than sig1 | wba | pass | pass | pass |
+| scenarios | R20 Second signature with tag cdn-edge | profile | pass | pass | 403 signature-invalid |
+| scenarios | R20b Second member with tag cdn-edge whose Signature value is a token | wba | 400 parse | 400 parse | 400 parse |
+| scenarios | R26 Signed for seller.example.com, verified by seller-b.example.com | profile | 403 authority | 403 authority | pass |
+| scenarios | D00 Baseline | wba | pass | pass | pass |
+| scenarios | D01 Signed for another authority | wba | 403 directory-signature | 403 directory-signature | 403 directory-signature |
+| scenarios | D02 Body changed after signing | profile | 403 directory-content-digest | 403 directory-content-digest | pass |
+| scenarios | D03 Unsigned | wba | 403 directory-one-signature-per-key | 403 directory-one-signature-per-key | 403 directory-signature |
+| scenarios | D04 Signature created in the future | wba | 403 directory-window | 403 directory-window | 403 directory-window |
+| scenarios | D05 Covers "@authority";req only | profile | 403 directory-components | 403 directory-components | pass |
+| scenarios | D06 Expired signature | wba | 403 directory-window | 403 directory-window | 403 directory-window |
+| scenarios | D07 Extra P-256 key that does not sign | wba | pass | pass | pass |
+| scenarios | D08 Media type application/json | profile | 403 directory-media-type | 403 directory-media-type | pass |
+| scenarios | D09 Signature expired one second ago | wba | 403 directory-window | 403 directory-window | 403 directory-window |
+| scenarios | D10 Signature that expires now | wba | pass | pass | pass |
+| scenarios | P00 Baseline, bound to the signed request | wba | pass | pass | pass |
+| scenarios | P01 Body changed after signing | profile | 403 content-digest | 403 content-digest | pass |
+| scenarios | P02 Status changed after signing | wba | 403 signature-invalid | 403 signature-invalid | 403 signature-invalid |
+| scenarios | P03 Signed request, response not bound to it | profile | 403 response-not-bound | 403 response-not-bound | pass |
+| scenarios | P04 Bound to another request | wba | 403 signature-invalid | 403 signature-invalid | 403 signature-invalid |
+| scenarios | P05 @status not covered | profile | 403 components | 403 components | pass |
+| scenarios | P06 Lifetime of 3600 seconds | profile | 403 lifetime | 403 lifetime | pass |
+| scenarios | P07 Unsigned request, response without a binding | wba | pass | pass | pass |
+| scenarios | P08 Response signed with tag other than web-bot-auth | profile | 403 signature-missing | 403 signature-missing | pass |
+
+## Differences from Cloudflare web-bot-auth 0.2.0
+
+The bare library differs from the profile in these ways. Each is a tier
+`profile` row above:
+
+- It accepts any `http` or `https` URL as a `Signature-Agent` value and leaves
+  key lookup to the caller's resolver. A resolver that derives the origin, as
+  -00 does, accepts an `http` URL (R16, R16b), another path, a trailing `/`, a
+  query, a fragment, userinfo, an uppercase host, or a port (R17 to R17j). WBA
+  requires `https`, so R16 is a library gap.
+- It accepts members with parameters, including `type=directory` and
+  `type=jwks_uri` (R18, R18c, R18d), which draft -01 says a verifier ignores.
+- It accepts a covered `Signature-Agent` member keyed to a label other than the
+  signature's (R19), and two `Signature-Agent` members (R21).
+- It accepts the legacy bare-string `Signature-Agent` (R15). WBA -00 lets a
+  verifier accept it; the profile parses the field only as a Dictionary, so the
+  request gets `400`.
+- It doesn't compare `Content-Digest` with the body, in requests (R01),
+  directories (D02), or responses (P01).
+- It allows no clock skew by default (R05) and allows a 24-hour lifetime (R06).
+- It treats the nonce as optional (R24, negative/001) and keeps no replay state
+  (negative/002).
+- It needs only one of `@authority` or `@target-uri` (R12), and no
+  `content-type` or `content-digest` with a body (R13, R13b).
+- It needs a label to pick one signature when a request carries two, whatever
+  their tags (R20).
+- It doesn't check the directory media type (D08) or that a directory signature
+  covers `content-digest` (D05).
+- It has no response profile, so it doesn't require the request binding (P03,
+  negative/007) or `@status` (P05).
+
+## Draft -00 and draft -01
+
+The profile follows draft-ietf-webbotauth-httpsig-protocol-01 (29 October
+2026): signers send the key directory URL that -01 defines, and verifiers also
+accept the bare origin a -00 signer sends. Cloudflare's library 0.2.0, which
+the interop harness runs, implements -00. Draft -01 changes the following:
+
+| Area | -00 | -01 | Effect on the profile |
+| :--- | :--- | :--- | :--- |
+| Key discovery (§ 5.5) | A `directory` member value is an origin; the verifier fetches the well-known path. Types `directory`, `jwks_uri`, and `cimd` | "A verifier fetches that URL directly and interprets the response as a JWK Set." The types are removed | Resolved: a signer sends the key directory URL, which a -01 verifier fetches directly. The verifier also accepts the bare origin a -00 signer sends and fetches the same URL. |
+| Origin-only value (§ 5.5) | "The member value MUST be the ASCII serialization of an origin as defined in Section 6.2 of [ORIGIN], and a verifier MUST ignore a member carrying anything else (an empty path / MAY be accepted though)." A trailing `/` was therefore allowed | Removed | A strict -00 verifier ignores the key URL a signer now sends. Cloudflare's 0.2.0 library doesn't enforce this rule: it passes the URL to the caller's resolver, which can derive the origin. |
+| Member parameters (§ 5.2.1) | A member carries `type`; absent means `directory` | "Dictionary members MUST NOT carry parameters. A verifier MUST ignore a member that carries parameters." | Applied: signers send no parameters, and the verifier ignores a member that carries any. Cloudflare 0.2.0 interop doesn't need `type=directory`: its signer sends none. |
+| `kid` at the well-known URL (§ 5.5) | `kid` is the thumbprint | `kid` MAY appear, and MUST be the thumbprint | Compatible. The library already refuses a directory `kid` that isn't the thumbprint. |
+| JWK `alg` (§ 5.5.1) | Restricted to HTTP Signature Algorithms | A JWK `alg` follows JOSE; the signature `alg` follows HTTP Signature Algorithms | Compatible. The library publishes no JWK `alg`. |
+| Requesting a signature (§ 5.3) | An origin MAY request one | An origin that expects one SHOULD request it with `Accept-Signature`, and SHOULD include `Accept-Signature` on the 403 | Compatible. Use `accept_signature()`. |
+| Distinct agents (§ 6.5) | Distinct keys and directories | Distinct `Signature-Agent` URLs, keys, and directories for a crawler and a user-directed agent | Compatible with one agent per origin. |
+| Test vectors (Appendix E) | Member `agent2`, covered as `key="agent2"` under label `sig2` | Member keyed to the label (`sig2`) | Compatible: the profile requires the member keyed to the label. |
+| Section numbers | C.10 Proxies and Intermediaries | C.11 (C.10 is now Rollout and Fallback) | Re-cite C.10 as C.11. Sections 5.x, 6.x, and B.1 keep their numbers. |
+
+The directory media type, directory signatures (Appendix B.1), the legacy
+bare-string form, `400` and `429`, and the nonce rules don't change.
+
+## Choices the profile leaves open
+
+The library makes these choices where the profile is silent:
+
+- A body is non-empty bytes. A request with an empty body covers no
+  `content-digest`.
+- The 60 s clock skew applies to directory signatures too, a deliberate
+  relaxation of Appendix B.1, which rejects any future `created`.
+- A directory signature lasts 24 hours by default (`PublishPolicy(lifetime=...)`).
+  The resolver treats a fetched directory as fresh for 300 s
+  (`CachePolicy.max_cache_age`), so a new or removed key shows within
+  five minutes, and an unknown `keyid` never triggers a fetch while the
+  directory is fresh. The `Cache-Control` header on the directory is not read.
+- A stale directory still answers while a refetch fails, until its earliest
+  `expires`; an expired entry is never used.
+- A failed fetch blocks fetches of that origin for 60 s, so a broken directory
+  isn't fetched on every request, whatever `keyid` a request names.
+- The verifier records a nonce only after the signature verifies, so a forged
+  request can't burn a real nonce.
+- A response signature may carry a nonce; the verifier neither requires nor
+  records it.
+- `MemoryNonceStore` refuses new nonces when full, with `503`, instead of
+  forgetting old ones, and keeps each pair for at least one second.
+- A request whose `web-bot-auth` signature has no `Signature` member gets an
+  unbound response.
+- A host in `Signature-Agent` is lowercase ASCII; an internationalized name
+  must arrive as its A-label. A dotted-decimal IPv4 or bracketed IPv6 literal
+  is a host; a name whose last label is a number, such as `127.1` or
+  `2130706433`, isn't.
+- Members with parameters are dropped before the verifier counts members, so
+  an ignored member doesn't make a request carry two.
diff --git a/pyproject.toml b/pyproject.toml
index 3ebe855..3d3a9a2 100644
--- a/pyproject.toml
+++ b/pyproject.toml
@@ -7,7 +7,7 @@ name = "iab-agentic-primitives"
 version = "0.5.1"
 description = "Shared contract library for IAB agentic advertising: primitives, wire protocol, state machines, conformance vectors"
 readme = "README.md"
-requires-python = ">=3.11"
+requires-python = ">=3.12"
 license = "Apache-2.0"
 dependencies = [
     "pydantic>=2",
@@ -30,6 +30,26 @@ harness = [
     "httpx>=0.27",
     "fastapi>=0.110",
 ]
+# Web Bot Auth profile (iab_agentic_primitives.web_bot_auth): request and
+# response signing, the signed key directory, and the resolver. This list is
+# the module's whole dependency set; the ASGI helpers are plain ASGI and need
+# nothing more.
+wba = [
+    # RFC 9421 signature bases, Ed25519 sign and verify, the ;key and ;req
+    # component parameters, and RFC 9530 Content-Digest. Pinned exactly: the
+    # module subclasses HTTPMessageVerifier, and a contract test guards it.
+    "http-message-signatures==3.0.0",
+    # RFC 8941 / RFC 9651 Structured Fields for Signature, Signature-Input, and
+    # Signature-Agent, with duplicate keys refused.
+    "http-sf>=1.5,<2",
+    # JWK and RFC 7638 / RFC 8037 thumbprints for OKP (Ed25519) keys.
+    "joserfc>=1.7.5,<2",
+    # IDNA-2008 (UTS #46) host canonicalization for the origin rule.
+    "idna>=3.7,<4",
+    "cryptography>=45.0.1",
+    # Directory fetches go through an httpx.AsyncClient the caller can inject.
+    "httpx>=0.28.1,<1",
+]
 
 [dependency-groups]
 dev = [
@@ -39,6 +59,23 @@ dev = [
     "httpx>=0.27",
     "fastapi>=0.110",
     "uvicorn>=0.29",
+    # The wba extra, with the same pins, so that `uv run pytest` runs the Web
+    # Bot Auth suite instead of skipping it. The extra stays for consumers.
+    "http-message-signatures==3.0.0",
+    "http-sf>=1.5,<2",
+    "joserfc>=1.7.5,<2",
+    "idna>=3.7,<4",
+    "cryptography>=45.0.1",
+    "httpx>=0.28.1,<1",
+    # The Web Bot Auth quality gates (`make quality`). Declared here so that
+    # `uv run <tool>` resolves to a locked copy, locally and in CI.
+    "mypy>=1.18.2",
+    # Exact, not a floor: how `# ast-grep-ignore:` directives are honoured has
+    # changed between releases, so a floor could silently change what the
+    # structural rules in .ast-grep/rules/ report.
+    "ast-grep-cli==0.45.3",
+    "import-linter>=2.1",
+    "pytest-cov>=6.2.1",
 ]
 
 [tool.hatch.build.targets.wheel]
@@ -46,7 +83,37 @@ packages = ["src/iab_agentic_primitives"]
 
 [tool.pytest.ini_options]
 testpaths = ["tests"]
+# A parametrize over an empty list fails collection instead of skipping, so a
+# generated case table that comes back empty cannot pass silently.
+empty_parameter_set_mark = "fail_at_collect"
+# An xfail that passes fails the run, so an exemption can't outlive its reason.
+xfail_strict = true
+# The interop tests need Node and the harness's libraries; `make interop` and
+# CI's web-bot-auth-interop job select them with `-m interop`.
+markers = ["interop: Web Bot Auth interop with Cloudflare's library, through Node"]
+addopts = ["-m", "not interop"]
 
 [tool.ruff]
 line-length = 100
-target-version = "py311"
+target-version = "py312"
+
+# mypy runs only through `make typecheck` (the Web Bot Auth gate). The
+# overrides match the web_bot_auth module and its tests alone, so upstream
+# modules are not held to these settings.
+[tool.mypy]
+python_version = "3.12"
+plugins = ["pydantic.mypy"]
+mypy_path = "src"
+explicit_package_bases = true
+
+[[tool.mypy.overrides]]
+module = "iab_agentic_primitives.web_bot_auth.*"
+strict = true
+disallow_any_explicit = true
+warn_unused_ignores = true
+
+[[tool.mypy.overrides]]
+module = "tests.web_bot_auth.*"
+strict = true
+disallow_any_explicit = true
+enable_error_code = ["truthy-bool", "possibly-undefined"]
diff --git a/ruff-wba-boundary.toml b/ruff-wba-boundary.toml
new file mode 100644
index 0000000..345925e
--- /dev/null
+++ b/ruff-wba-boundary.toml
@@ -0,0 +1,29 @@
+# The Web Bot Auth seam boundary (`make boundary`), run over
+# src/iab_agentic_primitives/web_bot_auth only.
+#
+# The RFC 9421 and Structured Fields libraries are reached through the wire
+# seams alone, and the network through the fetcher and the httpx edge alone.
+# A ban fires on the import, so a module that reaches past its seam fails
+# where it reaches.
+#
+# Relative imports are not banned here: ruff resolves them to absolute names,
+# so a ban on iab_agentic_primitives fires on every one of them. The ast-grep
+# rule no-absolute-self-import covers that case instead.
+extend = "pyproject.toml"
+
+[lint]
+select = ["TID251"]
+
+[lint.flake8-tidy-imports.banned-api]
+"http_message_signatures".msg = "Only the RFC 9421 seam (_sig.py) imports http_message_signatures."
+"http_sf".msg = "Only the Structured Fields seam (_wire.py) imports http_sf."
+"httpx".msg = "Only the directory fetcher and the httpx edge (httpx.py) import httpx."
+
+[lint.per-file-ignores]
+# The seams themselves.
+"**/web_bot_auth/_sig.py" = ["TID251"]
+"**/web_bot_auth/_wire.py" = ["TID251"]
+# The network edges: the directory fetcher, the httpx Auth, and test support.
+"**/web_bot_auth/fetcher.py" = ["TID251"]
+"**/web_bot_auth/httpx.py" = ["TID251"]
+"**/web_bot_auth/testing.py" = ["TID251"]
diff --git a/ruff-wba.toml b/ruff-wba.toml
new file mode 100644
index 0000000..fa57bb9
--- /dev/null
+++ b/ruff-wba.toml
@@ -0,0 +1,24 @@
+# The Web Bot Auth lint gate (`make lint-wba`). Scoped to
+# src/iab_agentic_primitives/web_bot_auth and tests/web_bot_auth.
+#
+# This set lives in its own file, not in pyproject.toml's [tool.ruff.lint],
+# because it reports findings in upstream modules, and `uv run ruff check .`
+# must keep passing for them as it does today.
+extend = "pyproject.toml"
+
+[lint]
+select = ["E", "W", "F", "I", "B", "C4", "UP", "C90", "PLR", "RUF100", "RUF022", "TID251"]
+ignore = [
+    "PLR2004", # magic values: protocol constants, each named where reused
+]
+
+# C901 has no baseline: the module is new. A per-file ignore is allowed only
+# for a fixture-heavy test function, with its reason beside it.
+
+[lint.mccabe]
+max-complexity = 10
+
+[lint.pylint]
+max-branches = 12
+max-statements = 50
+max-args = 5
diff --git a/sgconfig.yml b/sgconfig.yml
new file mode 100644
index 0000000..a1a0e15
--- /dev/null
+++ b/sgconfig.yml
@@ -0,0 +1,7 @@
+# Structural rules for the Web Bot Auth module (`make guards`), for the
+# checks ruff and import-linter cannot express. Each rule scopes itself to the
+# web_bot_auth paths with its own `files:`.
+#
+# Every rule is `severity: error`, so any finding fails the scan.
+ruleDirs:
+  - .ast-grep/rules
diff --git a/src/iab_agentic_primitives/conformance/gap_report_render.py b/src/iab_agentic_primitives/conformance/gap_report_render.py
index 38acbd5..c1d469b 100644
--- a/src/iab_agentic_primitives/conformance/gap_report_render.py
+++ b/src/iab_agentic_primitives/conformance/gap_report_render.py
@@ -152,19 +152,16 @@ def render_markdown(report: dict[str, Any]) -> str:
         "IAB = Interactive Advertising Bureau. This report answers a single "
         "question honestly: for each standard the shared contract claims "
         "alignment with, have we actually *verified* it, and if not, exactly "
-        "what is missing and how to close the gap. \"We model a field named "
-        "after a standard\" is never treated as \"we verified conformance "
-        "against the published standard\"."
+        'what is missing and how to close the gap. "We model a field named '
+        'after a standard" is never treated as "we verified conformance '
+        'against the published standard".'
     )
     lines.append("")
 
     # ---- Executive summary --------------------------------------------------
     lines.append("## Executive summary")
     lines.append("")
-    lines.append(
-        f"- **{len(standards)} standards tracked** (library version "
-        f"`{version}`)."
-    )
+    lines.append(f"- **{len(standards)} standards tracked** (library version `{version}`).")
     lines.append(
         f"- **{len(conformant)} fully self-conformant** — the contract's own "
         "guarantees (primitives, protocol, state, events, money, idempotency, "
@@ -198,12 +195,10 @@ def render_markdown(report: dict[str, Any]) -> str:
     top = next((s for s in standards if s["id"] == HIGHEST_PRIORITY_GAP_ID), None)
     if top is not None:
         lines.append(
-            f"**Highest-priority gap: {top['name']} "
-            f"{top.get('version', '')}".strip()
+            f"**Highest-priority gap: {top['name']} {top.get('version', '')}".strip()
             + "** — field-level fidelity for the core commercial booking "
             "surface (Orders / Lines / Products) is the most consequential "
-            "unverified claim. "
-            + REMEDIATION.get(top["id"], "")
+            "unverified claim. " + REMEDIATION.get(top["id"], "")
         )
         lines.append("")
 
diff --git a/src/iab_agentic_primitives/conformance/report.py b/src/iab_agentic_primitives/conformance/report.py
index d520608..56ef01c 100644
--- a/src/iab_agentic_primitives/conformance/report.py
+++ b/src/iab_agentic_primitives/conformance/report.py
@@ -108,9 +108,7 @@ def summary(self) -> dict[str, Any]:
         vectors: set[tuple[str, str, str]] = set()
         targets: set[tuple[str, str]] = set()
         for record in self.checks:
-            area = areas.setdefault(
-                record.area, {status.value: 0 for status in CheckStatus}
-            )
+            area = areas.setdefault(record.area, {status.value: 0 for status in CheckStatus})
             area[record.status.value] += 1
             targets.add((record.area, record.target))
             if record.vector is not None:
@@ -149,13 +147,11 @@ def render_table(self) -> str:
         lines.append(f"generated: {self.generated_at.isoformat()}")
         lines.append("")
         lines.append(
-            "checks: {checks} total | {passed} passed | {failed} failed | "
-            "{skipped} skipped".format(**summary)
-        )
-        lines.append(
-            f"coverage: {summary['vectors']} vectors across "
-            f"{summary['targets']} targets"
+            "checks: {checks} total | {passed} passed | {failed} failed | {skipped} skipped".format(
+                **summary
+            )
         )
+        lines.append(f"coverage: {summary['vectors']} vectors across {summary['targets']} targets")
         for area, counts in sorted(summary["by_area"].items()):
             lines.append(
                 f"  {area:<11} pass={counts['pass']:<4} fail={counts['fail']:<3} "
diff --git a/src/iab_agentic_primitives/conformance/runner.py b/src/iab_agentic_primitives/conformance/runner.py
index 9334ff2..cbd488f 100644
--- a/src/iab_agentic_primitives/conformance/runner.py
+++ b/src/iab_agentic_primitives/conformance/runner.py
@@ -101,9 +101,7 @@ def _record(
         diff: list[dict[str, str]] | None = None,
     ) -> None:
         """Record one check; ``ok=None`` means the check was skipped."""
-        status = (
-            CheckStatus.SKIP if ok is None else CheckStatus.PASS if ok else CheckStatus.FAIL
-        )
+        status = CheckStatus.SKIP if ok is None else CheckStatus.PASS if ok else CheckStatus.FAIL
         self.report.checks.append(
             CheckRecord(
                 area=area,
@@ -208,9 +206,7 @@ def _run_vector(
         if mode == "must_ignore":
             expected = vector.get("expected", data)
             check = "must_ignore"
-            failure = (
-                "unknown/x_ extension fields were not ignored on re-serialization (FD-13)"
-            )
+            failure = "unknown/x_ extension fields were not ignored on re-serialization (FD-13)"
         else:
             expected = data
             check = "roundtrip"
@@ -449,10 +445,7 @@ def fail(message: str) -> None:
                         return
                 elif index == fails_at:
                     if json_legal:
-                        fail(
-                            f"illegal transition ACCEPTED at step {index}: "
-                            f"{src!r} -> {dst!r}"
-                        )
+                        fail(f"illegal transition ACCEPTED at step {index}: {src!r} -> {dst!r}")
                         return
                     break  # rejected exactly where expected
         else:
@@ -498,11 +491,7 @@ def _check_state_spec_sync(self) -> None:
                 vector=None,
                 check="state_spec_sync",
                 ok=ok,
-                message=(
-                    ""
-                    if ok
-                    else f"state machine has drifted from checked-in {path.name}"
-                ),
+                message=("" if ok else f"state machine has drifted from checked-in {path.name}"),
             )
 
     # -- entry point -----------------------------------------------------------
@@ -514,9 +503,7 @@ def run(self) -> GapReport:
         return self.report
 
 
-def run_conformance(
-    fixtures_dir: Path | None = None, schema_dir: Path | None = None
-) -> GapReport:
+def run_conformance(fixtures_dir: Path | None = None, schema_dir: Path | None = None) -> GapReport:
     """Run every conformance check and return the assembled GapReport."""
     return ConformanceRunner(fixtures_dir=fixtures_dir, schema_dir=schema_dir).run()
 
diff --git a/src/iab_agentic_primitives/conformance/vectors.py b/src/iab_agentic_primitives/conformance/vectors.py
index 8a3681f..cfea1d9 100644
--- a/src/iab_agentic_primitives/conformance/vectors.py
+++ b/src/iab_agentic_primitives/conformance/vectors.py
@@ -173,6 +173,7 @@ def _doc(area: str, target: str, vectors: list[dict[str, Any]]) -> dict[str, Any
         "vectors": vectors,
     }
 
+
 # Pinned timestamps -- regeneration must be byte-stable.
 T0 = datetime(2026, 7, 1, 12, 0, 0, tzinfo=UTC)
 T1 = datetime(2026, 7, 2, 9, 30, 0, tzinfo=UTC)
@@ -307,9 +308,7 @@ def _quote_pg_digital() -> Quote:
             flight_end=date(2026, 8, 31),
             guaranteed=True,
         ),
-        availability=QuoteAvailability(
-            inventory_available=True, estimated_fill_rate=0.95
-        ),
+        availability=QuoteAvailability(inventory_available=True, estimated_fill_rate=0.95),
         buyer_tier=AccessTier.ADVERTISER,
         rate_card_id="rc-001",
         expires_at=T_EXPIRES,
@@ -323,9 +322,7 @@ def _quote_linear_tv() -> Quote:
     return Quote(
         quote_id="q-ltv-002",
         deal_type=DealType.PROGRAMMATIC_GUARANTEED,
-        product=ProductRef(
-            product_id="prod-ltv-9", name="Primetime National Spots"
-        ),
+        product=ProductRef(product_id="prod-ltv-9", name="Primetime National Spots"),
         pricing=QuotePricing(
             pricing_model=PricingModel.CPP,
             base_cpp=Money.from_decimal_str("475.00"),
@@ -688,8 +685,7 @@ def primitive_fixture_docs() -> dict[str, dict[str, Any]]:
             _valid("pg_digital_guaranteed", "Happy-path PG digital quote", _quote_pg_digital()),
             _valid(
                 "linear_tv_primetime",
-                "FD-6 linear TV quote: CPP pricing, GRP terms, structured "
-                "linear_tv details",
+                "FD-6 linear TV quote: CPP pricing, GRP terms, structured linear_tv details",
                 _quote_linear_tv(),
             ),
             _valid(
@@ -871,9 +867,7 @@ def primitive_fixture_docs() -> dict[str, dict[str, Any]]:
                     deal_type=DealType.PROGRAMMATIC_GUARANTEED,
                     status=DealStatus.MAKEGOOD_PENDING,
                     quote_id="q-ltv-002",
-                    product=ProductRef(
-                        product_id="prod-ltv-9", name="Primetime National Spots"
-                    ),
+                    product=ProductRef(product_id="prod-ltv-9", name="Primetime National Spots"),
                     pricing=QuotePricing(
                         pricing_model=PricingModel.CPP,
                         base_cpp=Money.from_decimal_str("475.00"),
@@ -1027,9 +1021,7 @@ def primitive_fixture_docs() -> dict[str, dict[str, Any]]:
                     requested_by="human:ops-42",
                     requested_at=T0,
                     reason="Campaign paused by advertiser",
-                    diffs=[
-                        FieldDiff(field="status", old_value="booked", new_value="cancelled")
-                    ],
+                    diffs=[FieldDiff(field="status", old_value="booked", new_value="cancelled")],
                     proposed_values={
                         "cancel_pct": 1.0,
                         "reason": "advertiser pause",
@@ -1063,9 +1055,7 @@ def primitive_fixture_docs() -> dict[str, dict[str, Any]]:
                 "Active session with revealed buyer identity",
                 Session(
                     session_id="sess-001",
-                    buyer_identity=BuyerIdentity(
-                        seat_id="ttd-seat-123", agency_id="omnicom-456"
-                    ),
+                    buyer_identity=BuyerIdentity(seat_id="ttd-seat-123", agency_id="omnicom-456"),
                     messages=[
                         SessionMessage(
                             role="user",
@@ -1453,9 +1443,7 @@ def protocol_fixture_docs() -> dict[str, dict[str, Any]]:
             _valid(
                 "one_product",
                 "Catalog page with a single product",
-                ProductListResponse(
-                    products=[product], total_count=1, limit=50, offset=0
-                ),
+                ProductListResponse(products=[product], total_count=1, limit=50, offset=0),
             ),
             _valid(
                 "empty_catalog",
@@ -1667,11 +1655,8 @@ def _spec_avails(
         [
             _valid(
                 "fully_available",
-                "Full requested volume available: availsstatus Available, "
-                "no reason",
-                _spec_avails(
-                    "prod-001", 500_000, AvailsStatusValue.AVAILABLE, None
-                ),
+                "Full requested volume available: availsstatus Available, no reason",
+                _spec_avails("prod-001", 500_000, AvailsStatusValue.AVAILABLE, None),
             ),
             _valid(
                 "partially_available_booked",
@@ -1736,8 +1721,7 @@ def _spec_avails(
             ),
             _valid(
                 "empty_collection",
-                "No matching availability: the avails array is empty, "
-                "never absent",
+                "No matching availability: the avails array is empty, never absent",
                 AvailsCollection(avails=[]),
             ),
             _must_ignore(
@@ -1800,8 +1784,7 @@ def _spec_avails(
             ),
             _invalid(
                 "missing_idempotency_key",
-                "FD-12: a money-mutating request without idempotency_key "
-                "must be rejected",
+                "FD-12: a money-mutating request without idempotency_key must be rejected",
                 {"product_id": "prod-001", "deal_type": "PG", "impressions": 1000000},
                 "idempotency_key",
             ),
@@ -1818,8 +1801,7 @@ def _spec_avails(
             ),
             _invalid(
                 "linear_tv_missing_params",
-                "FD-6: media_type linear_tv without linear_tv params must "
-                "be rejected",
+                "FD-6: media_type linear_tv without linear_tv params must be rejected",
                 {
                     "idempotency_key": _idem(4),
                     "product_id": "prod-ltv-9",
@@ -1927,8 +1909,7 @@ def _spec_avails(
             ),
             _valid(
                 "cancellation_create",
-                "Cancellation as a typed change request (retired per-deal "
-                "cancel route)",
+                "Cancellation as a typed change request (retired per-deal cancel route)",
                 ChangeRequestCreate(
                     idempotency_key=_idem(8),
                     order_id="ord-001",
@@ -1944,8 +1925,7 @@ def _spec_avails(
             ),
             _invalid(
                 "makegood_missing_details",
-                "change_type makegood without a makegood payload must be "
-                "rejected",
+                "change_type makegood without a makegood payload must be rejected",
                 {
                     "idempotency_key": _idem(9),
                     "deal_id": "deal-ltv-002",
@@ -2028,8 +2008,7 @@ def _spec_avails(
             ),
             _must_ignore(
                 "message_with_unknown_fields",
-                "FD-13: unknown + x_ fields on a negotiation message are "
-                "ignored",
+                "FD-13: unknown + x_ fields on a negotiation message are ignored",
                 open_counter,
             ),
             _invalid(
@@ -2138,8 +2117,7 @@ def _spec_avails(
             ),
             _must_ignore(
                 "request_with_unknown_fields",
-                "FD-13: unknown + x_ fields on the JSON-RPC envelope are "
-                "ignored",
+                "FD-13: unknown + x_ fields on the JSON-RPC envelope are ignored",
                 rpc_request,
             ),
         ],
@@ -2265,8 +2243,7 @@ def _spec_avails(
                 ErrorEnvelope(
                     detail=ErrorDetail(
                         error=ErrorCode.IDEMPOTENCY_CONFLICT,
-                        message="idempotency_key was already used with a "
-                        "different request body",
+                        message="idempotency_key was already used with a different request body",
                     )
                 ),
             ),
diff --git a/src/iab_agentic_primitives/harness/assertions.py b/src/iab_agentic_primitives/harness/assertions.py
index b233349..ef412c0 100644
--- a/src/iab_agentic_primitives/harness/assertions.py
+++ b/src/iab_agentic_primitives/harness/assertions.py
@@ -45,8 +45,7 @@ def assert_quote_roundtrips(result: TransactionResult) -> None:
         quote = ex.response.quote
         assert quote.quote_id, "quote is missing a seller-minted quote_id"
         assert quote.product.product_id == request.product_id, (
-            f"quote product {quote.product.product_id!r} != requested "
-            f"{request.product_id!r}"
+            f"quote product {quote.product.product_id!r} != requested {request.product_id!r}"
         )
         assert quote.deal_type == request.deal_type, (
             f"quote deal_type {quote.deal_type} != requested {request.deal_type}"
@@ -140,9 +139,7 @@ def assert_auth_tier_enforced(result: TransactionResult, *, expected_tier: Acces
 
     assert result.quote is not None, "no quote to check the tier on"
     granted = result.quote.buyer_tier
-    assert granted == expected_tier, (
-        f"granted tier {granted} != expected {expected_tier}"
-    )
+    assert granted == expected_tier, f"granted tier {granted} != expected {expected_tier}"
     assert TIER_ORDER[granted] <= TIER_ORDER[result.tier_ceiling], (
         f"granted tier {granted} exceeds the registry ceiling {result.tier_ceiling}"
     )
@@ -152,8 +149,7 @@ def assert_idempotent_booking(result: TransactionResult) -> None:
     """Re-booking with the same idempotency key returned the SAME single deal."""
     assert result.deal is not None, "no deal to check idempotency on"
     assert result.replay_deal is not None, (
-        "idempotency probe did not run: replay_deal is None "
-        "(set brief.idempotent_double_book=True)"
+        "idempotency probe did not run: replay_deal is None (set brief.idempotent_double_book=True)"
     )
     assert result.replay_deal.deal_id == result.deal.deal_id, (
         f"replay minted a different deal: {result.replay_deal.deal_id!r} != "
@@ -169,14 +165,10 @@ def assert_state_consistent(result: TransactionResult) -> None:
     assert result.reconciliation.outcome is ReconciliationOutcome.CONSISTENT, (
         f"deal state reconciled as {result.reconciliation.outcome.value}, not consistent"
     )
-    assert result.disagreement is None, (
-        f"unexpected DisagreementReport: {result.disagreement}"
-    )
+    assert result.disagreement is None, f"unexpected DisagreementReport: {result.disagreement}"
 
 
-def assert_structural_rejection(
-    result: TransactionResult, surface: str, code: ErrorCode
-) -> None:
+def assert_structural_rejection(result: TransactionResult, surface: str, code: ErrorCode) -> None:
     """A given surface produced at least one structured rejection with ``code``.
 
     Useful for the FD-6 checks (linear_tv / unsupported deal type): the
diff --git a/src/iab_agentic_primitives/harness/reference_agents.py b/src/iab_agentic_primitives/harness/reference_agents.py
index 5ae2481..d26f4f2 100644
--- a/src/iab_agentic_primitives/harness/reference_agents.py
+++ b/src/iab_agentic_primitives/harness/reference_agents.py
@@ -109,7 +109,9 @@
 DEFAULT_NEGOTIATION_BAND_PER_MILLE = 1250
 
 
-def _err(code: ErrorCode, message: str, unsupported: list[UnsupportedItem] | None = None) -> ErrorEnvelope:
+def _err(
+    code: ErrorCode, message: str, unsupported: list[UnsupportedItem] | None = None
+) -> ErrorEnvelope:
     return ErrorEnvelope(
         detail=ErrorDetail(error=code, message=message, unsupported=unsupported or [])
     )
@@ -130,7 +132,16 @@ def __init__(self, quote, floor_micros: int, product_id: str, effective_tier: Ac
 class _NegState:
     """Seller-internal negotiation record (guardrails stay off the wire)."""
 
-    __slots__ = ("negotiation_id", "quote_id", "seller_price", "floor_micros", "rounds", "status", "last_buyer_price", "start_price")
+    __slots__ = (
+        "negotiation_id",
+        "quote_id",
+        "seller_price",
+        "floor_micros",
+        "rounds",
+        "status",
+        "last_buyer_price",
+        "start_price",
+    )
 
     def __init__(self, negotiation_id: str, quote_id: str, seller_price: int, floor_micros: int):
         self.negotiation_id = negotiation_id
@@ -263,7 +274,11 @@ def price_quote(
                 [UnsupportedItem(capability=request.media_type.value)],
             )
         terms = product.commercial_terms
-        if terms and terms.supported_deal_types and request.deal_type not in terms.supported_deal_types:
+        if (
+            terms
+            and terms.supported_deal_types
+            and request.deal_type not in terms.supported_deal_types
+        ):
             return _err(
                 ErrorCode.UNSUPPORTED_CAPABILITY,
                 f"deal_type {request.deal_type.value!r} not supported for this product",
@@ -317,7 +332,9 @@ def handle_negotiation(
         if isinstance(neg, ErrorEnvelope):
             return neg
         if neg.status is not NegotiationStatus.ACTIVE:
-            return _err(ErrorCode.NEGOTIATION_CLOSED, f"negotiation {neg.negotiation_id} is terminal")
+            return _err(
+                ErrorCode.NEGOTIATION_CLOSED, f"negotiation {neg.negotiation_id} is terminal"
+            )
 
         response = self._advance(neg, message)
         self._neg_replay[message.idempotency_key] = response
@@ -339,7 +356,10 @@ def _resolve_negotiation(self, message: NegotiationMessage) -> _NegState | Error
             return _err(ErrorCode.NOT_FOUND, f"unknown quote {message.quote_id!r}")
         neg_id = self._mint("neg")
         neg = _NegState(
-            neg_id, message.quote_id, qstate.quote.pricing.final_cpm.amount_micros, qstate.floor_micros
+            neg_id,
+            message.quote_id,
+            qstate.quote.pricing.final_cpm.amount_micros,
+            qstate.floor_micros,
         )
         self._negotiations[neg_id] = neg
         self._neg_by_quote[message.quote_id] = neg_id
@@ -355,14 +375,22 @@ def _advance(self, neg: _NegState, message: NegotiationMessage) -> NegotiationRo
         if message.action is NegotiationAction.ACCEPT:
             neg.status = NegotiationStatus.ACCEPTED
             return self._record_round(
-                neg, round_number, neg.last_buyer_price, neg.seller_price,
-                NegotiationAction.ACCEPT, currency,
+                neg,
+                round_number,
+                neg.last_buyer_price,
+                neg.seller_price,
+                NegotiationAction.ACCEPT,
+                currency,
             )
         if message.action is NegotiationAction.REJECT:
             neg.status = NegotiationStatus.REJECTED
             return self._record_round(
-                neg, round_number, neg.last_buyer_price, neg.seller_price,
-                NegotiationAction.REJECT, currency,
+                neg,
+                round_number,
+                neg.last_buyer_price,
+                neg.seller_price,
+                NegotiationAction.REJECT,
+                currency,
             )
 
         # counter / final_offer: buyer_price is required by the envelope
@@ -390,7 +418,9 @@ def _advance(self, neg: _NegState, message: NegotiationMessage) -> NegotiationRo
             new_price = max(neg.floor_micros, (neg.seller_price + bp) // 2)
             if new_price <= bp:
                 neg.status = NegotiationStatus.ACCEPTED
-                return self._record_round(neg, round_number, bp, bp, NegotiationAction.ACCEPT, currency)
+                return self._record_round(
+                    neg, round_number, bp, bp, NegotiationAction.ACCEPT, currency
+                )
             neg.seller_price = new_price
             action = (
                 NegotiationAction.FINAL_OFFER
@@ -410,12 +440,15 @@ def _advance(self, neg: _NegState, message: NegotiationMessage) -> NegotiationRo
         )
 
     def _record_round(
-        self, neg: _NegState, round_number: int, buyer_micros: int, seller_micros: int,
-        action: NegotiationAction, currency: str,
+        self,
+        neg: _NegState,
+        round_number: int,
+        buyer_micros: int,
+        seller_micros: int,
+        action: NegotiationAction,
+        currency: str,
     ) -> NegotiationRoundResponse:
-        concession = (
-            (neg.start_price - seller_micros) / neg.start_price if neg.start_price else 0.0
-        )
+        concession = (neg.start_price - seller_micros) / neg.start_price if neg.start_price else 0.0
         rnd = NegotiationRound(
             round_number=round_number,
             buyer_price=Money(amount_micros=buyer_micros, currency=currency),
@@ -584,9 +617,7 @@ def agent_card(self) -> AgentCard:
 
     # -- driver ------------------------------------------------------------
 
-    def transact(
-        self, brief: CampaignBrief, sellers: Sequence[SellerChannel]
-    ) -> BuyerOutcome:
+    def transact(self, brief: CampaignBrief, sellers: Sequence[SellerChannel]) -> BuyerOutcome:
         best = self._discover_cheapest(brief, sellers)
         if best is None:
             return BuyerOutcome(walked_away=True, walk_reason="no affordable quote under max_cpm")
@@ -598,9 +629,7 @@ def transact(
         # brings it down to the ceiling, so negotiation is REQUIRED for it —
         # the brief's ``negotiate`` flag only governs voluntary negotiation
         # on quotes already at/below the ceiling.
-        must_negotiate = (
-            quote.pricing.final_cpm.amount_micros > brief.max_cpm.amount_micros
-        )
+        must_negotiate = quote.pricing.final_cpm.amount_micros > brief.max_cpm.amount_micros
         effective_cpm = quote.pricing.final_cpm
         if brief.negotiate or must_negotiate:
             negotiation, agreed = self._negotiate(
@@ -630,9 +659,7 @@ def transact(
         cost = cpm_cost(effective_cpm, brief.impressions)
         if cost.amount_micros > brief.budget.amount_micros:
             outcome.walked_away = True
-            outcome.walk_reason = (
-                f"budget ceiling exceeded: cost {cost.amount_micros} > budget {brief.budget.amount_micros}"
-            )
+            outcome.walk_reason = f"budget ceiling exceeded: cost {cost.amount_micros} > budget {brief.budget.amount_micros}"
             return outcome
 
         return self._book(brief, channel, quote, outcome)
@@ -675,7 +702,11 @@ def _pick_product(self, brief: CampaignBrief, products) -> Product | None:
             if brief.ad_format and brief.ad_format not in product.ad_formats:
                 continue
             terms = product.commercial_terms
-            if terms and terms.supported_deal_types and brief.deal_type not in terms.supported_deal_types:
+            if (
+                terms
+                and terms.supported_deal_types
+                and brief.deal_type not in terms.supported_deal_types
+            ):
                 continue
             if product.base_price is None:
                 continue
diff --git a/src/iab_agentic_primitives/harness/roles.py b/src/iab_agentic_primitives/harness/roles.py
index 406ae37..4794a5c 100644
--- a/src/iab_agentic_primitives/harness/roles.py
+++ b/src/iab_agentic_primitives/harness/roles.py
@@ -304,9 +304,7 @@ def agent_card(self) -> AgentCard:
         """The buyer's Agent Card, as registered for discovery/trust."""
 
     @abstractmethod
-    def transact(
-        self, brief: CampaignBrief, sellers: Sequence[SellerChannel]
-    ) -> BuyerOutcome:
+    def transact(self, brief: CampaignBrief, sellers: Sequence[SellerChannel]) -> BuyerOutcome:
         """Run the brief against the discovered sellers; return the outcome."""
 
 
diff --git a/src/iab_agentic_primitives/harness/scenario.py b/src/iab_agentic_primitives/harness/scenario.py
index 8294419..ce5732d 100644
--- a/src/iab_agentic_primitives/harness/scenario.py
+++ b/src/iab_agentic_primitives/harness/scenario.py
@@ -244,9 +244,7 @@ async def run_scenario(
 
         transactions: list[TransactionResult] = []
         for participant in buyers:
-            transactions.append(
-                await _run_one(client, participant, seller_by_id)
-            )
+            transactions.append(await _run_one(client, participant, seller_by_id))
 
     return ScenarioResult(transactions=transactions)
 
diff --git a/src/iab_agentic_primitives/primitives/_util.py b/src/iab_agentic_primitives/primitives/_util.py
index b46fc1e..60a5035 100644
--- a/src/iab_agentic_primitives/primitives/_util.py
+++ b/src/iab_agentic_primitives/primitives/_util.py
@@ -65,7 +65,5 @@ def from_decimal_str(cls, amount: str, currency: str = "USD") -> "Money":
         """
         micros = Decimal(amount) * 1_000_000
         if micros != micros.to_integral_value():
-            raise ValueError(
-                f"{amount!r} has more precision than micros can represent"
-            )
+            raise ValueError(f"{amount!r} has more precision than micros can represent")
         return cls(amount_micros=int(micros), currency=currency)
diff --git a/src/iab_agentic_primitives/primitives/creative.py b/src/iab_agentic_primitives/primitives/creative.py
index 8436a27..ce7576b 100644
--- a/src/iab_agentic_primitives/primitives/creative.py
+++ b/src/iab_agentic_primitives/primitives/creative.py
@@ -125,9 +125,7 @@ class CreativeApproval(WireModel):
     approval_id: str = Field(description="Seller-issued approval decision identifier.")
     creative_id: str = Field(description="Seller-issued id of the creative reviewed.")
     status: ReviewStatus = Field(description="Outcome of this review decision.")
-    reviewer: str = Field(
-        description="Actor id: 'system', 'human:<id>', or 'agent:<id>'."
-    )
+    reviewer: str = Field(description="Actor id: 'system', 'human:<id>', or 'agent:<id>'.")
     reason: str | None = Field(
         default=None,
         description="Rationale, required in practice for a rejection.",
diff --git a/src/iab_agentic_primitives/primitives/identity.py b/src/iab_agentic_primitives/primitives/identity.py
index a33e4d6..e24820e 100644
--- a/src/iab_agentic_primitives/primitives/identity.py
+++ b/src/iab_agentic_primitives/primitives/identity.py
@@ -86,9 +86,7 @@ class Account(WireModel):
     """
 
     account_id: str = Field(description="Seller-issued account identifier.")
-    buyer_organization_id: str = Field(
-        description="Registry-issued id of the buying organization."
-    )
+    buyer_organization_id: str = Field(description="Registry-issued id of the buying organization.")
     seller_organization_id: str = Field(
         description="Registry-issued id of the selling organization."
     )
diff --git a/src/iab_agentic_primitives/primitives/inventory.py b/src/iab_agentic_primitives/primitives/inventory.py
index 6fb489b..c66fec9 100644
--- a/src/iab_agentic_primitives/primitives/inventory.py
+++ b/src/iab_agentic_primitives/primitives/inventory.py
@@ -157,9 +157,7 @@ class Package(WireModel):
         description="Audience capability declaration. Kept as an open object here; "
         "the typed model lands with the audience-plan bead.",
     )
-    device_types: list[int] = Field(
-        default_factory=list, description="AdCOM DeviceType integers."
-    )
+    device_types: list[int] = Field(default_factory=list, description="AdCOM DeviceType integers.")
     ad_formats: list[str] = Field(default_factory=list)
     geo_targets: list[str] = Field(
         default_factory=list, description='ISO 3166-2 codes, e.g. ["US", "US-NY"].'
diff --git a/src/iab_agentic_primitives/primitives/lifecycle.py b/src/iab_agentic_primitives/primitives/lifecycle.py
index 010f9e9..a276478 100644
--- a/src/iab_agentic_primitives/primitives/lifecycle.py
+++ b/src/iab_agentic_primitives/primitives/lifecycle.py
@@ -232,9 +232,7 @@ class NegotiationRound(WireModel):
         description="What the seller countered (or accepted at) this round."
     )
     action: NegotiationAction
-    concession_pct: float = Field(
-        default=0.0, description="Seller concession this round (0-1)."
-    )
+    concession_pct: float = Field(default=0.0, description="Seller concession this round (0-1).")
     cumulative_concession_pct: float = Field(
         default=0.0, description="Total seller concession so far (0-1)."
     )
@@ -257,13 +255,9 @@ class Negotiation(WireModel):
     proposal_id: str | None = Field(
         default=None, description="Proposal under negotiation, if proposal-led."
     )
-    quote_id: str | None = Field(
-        default=None, description="Quote under negotiation, if quote-led."
-    )
+    quote_id: str | None = Field(default=None, description="Quote under negotiation, if quote-led.")
     product_id: str | None = None
-    package_id: str | None = Field(
-        default=None, description="Set when negotiating on a package."
-    )
+    package_id: str | None = Field(default=None, description="Set when negotiating on a package.")
     buyer_tier: AccessTier = AccessTier.PUBLIC
     rounds: list[NegotiationRound] = Field(default_factory=list)
     status: NegotiationStatus = NegotiationStatus.ACTIVE
@@ -287,9 +281,7 @@ class OpenRTBParams(WireModel):
     )
     at: int = Field(default=3, description="Auction type (3 = fixed price).")
     wseat: list[str] = Field(default_factory=list, description="Allowed buyer seats.")
-    wadomain: list[str] = Field(
-        default_factory=list, description="Allowed advertiser domains."
-    )
+    wadomain: list[str] = Field(default_factory=list, description="Allowed advertiser domains.")
 
 
 class Deal(WireModel):
@@ -358,9 +350,7 @@ class Order(WireModel):
     proposal_id: str | None = Field(
         default=None, description="Proposal this order materializes, if any."
     )
-    deal_id: str | None = Field(
-        default=None, description="Deal this order fulfils, if deal-led."
-    )
+    deal_id: str | None = Field(default=None, description="Deal this order fulfils, if deal-led.")
     name: str = Field(max_length=200)
     budget: Money = Field(description="Estimated budget (exact micros; FD-11).")
     start_date: date
diff --git a/src/iab_agentic_primitives/primitives/pricing.py b/src/iab_agentic_primitives/primitives/pricing.py
index 41fc7e2..e56da6e 100644
--- a/src/iab_agentic_primitives/primitives/pricing.py
+++ b/src/iab_agentic_primitives/primitives/pricing.py
@@ -151,12 +151,8 @@ class CancellationTerms(WireModel):
     cancellable_pct: float = Field(
         ge=0.0, le=1.0, description="Portion of the deal that can be cancelled (0.0-1.0)."
     )
-    deadline: date | None = Field(
-        default=None, description="Absolute deadline for cancellation."
-    )
-    force_majeure: bool = Field(
-        default=True, description="Whether force majeure exceptions apply."
-    )
+    deadline: date | None = Field(default=None, description="Absolute deadline for cancellation.")
+    force_majeure: bool = Field(default=True, description="Whether force majeure exceptions apply.")
 
 
 class LinearTVQuoteDetails(WireModel):
@@ -314,9 +310,7 @@ class QuoteTerms(WireModel):
         default=None, description="Linear TV volume in GRPs (gross rating points)."
     )
     guaranteed_grps: int | None = None
-    target_demo: str | None = Field(
-        default=None, description="Linear TV target demographic."
-    )
+    target_demo: str | None = Field(default=None, description="Linear TV target demographic.")
 
 
 class QuoteAvailability(WireModel):
diff --git a/src/iab_agentic_primitives/primitives/supply_chain.py b/src/iab_agentic_primitives/primitives/supply_chain.py
index 0d21403..fe2995b 100644
--- a/src/iab_agentic_primitives/primitives/supply_chain.py
+++ b/src/iab_agentic_primitives/primitives/supply_chain.py
@@ -36,9 +36,7 @@ class SupplyChainNode(WireModel):
     system's sellers.json.
     """
 
-    asi: str = Field(
-        description="Advertising system identifier (canonical domain of the system)."
-    )
+    asi: str = Field(description="Advertising system identifier (canonical domain of the system).")
     sid: str = Field(
         description="Seller id within the ``asi`` system; matches its sellers.json seller_id."
     )
@@ -107,9 +105,7 @@ class SellersJsonEntry(WireModel):
     translate at the edge.
     """
 
-    seller_id: str = Field(
-        description="Opaque seller id, unique within the publishing system."
-    )
+    seller_id: str = Field(description="Opaque seller id, unique within the publishing system.")
     name: str | None = Field(
         default=None, description="Seller business name; None when confidential."
     )
diff --git a/src/iab_agentic_primitives/protocol/a2a.py b/src/iab_agentic_primitives/protocol/a2a.py
index 81df177..d6c0625 100644
--- a/src/iab_agentic_primitives/protocol/a2a.py
+++ b/src/iab_agentic_primitives/protocol/a2a.py
@@ -51,9 +51,7 @@ class A2APart(A2AWireModel):
 
     kind: Literal["text", "data"]
     text: str | None = Field(default=None, description="Set when kind == 'text'.")
-    data: dict[str, Any] | None = Field(
-        default=None, description="Set when kind == 'data'."
-    )
+    data: dict[str, Any] | None = Field(default=None, description="Set when kind == 'data'.")
 
     @model_validator(mode="after")
     def _kind_consistency(self) -> "A2APart":
@@ -67,9 +65,7 @@ def _kind_consistency(self) -> "A2APart":
 class A2AMessage(A2AWireModel):
     """An A2A message (the A2A-spec shape the buyer already sent)."""
 
-    message_id: str = Field(
-        alias="messageId", description="Sender-minted unique message id."
-    )
+    message_id: str = Field(alias="messageId", description="Sender-minted unique message id.")
     role: Literal["user", "agent"] = "user"
     parts: list[A2APart] = Field(min_length=1)
 
diff --git a/src/iab_agentic_primitives/protocol/avails.py b/src/iab_agentic_primitives/protocol/avails.py
index 9677a59..d89d975 100644
--- a/src/iab_agentic_primitives/protocol/avails.py
+++ b/src/iab_agentic_primitives/protocol/avails.py
@@ -113,9 +113,7 @@ class AvailsRequest(AvailsWireModel):
     """
 
     product_id: str = Field(alias="productid", description="Product to check.")
-    start_date: datetime = Field(
-        alias="startdate", description="Flight start (ISO-8601)."
-    )
+    start_date: datetime = Field(alias="startdate", description="Flight start (ISO-8601).")
     end_date: datetime = Field(
         alias="enddate",
         description="Flight end (ISO-8601); must be after startdate.",
@@ -196,8 +194,7 @@ class AvailsResponse(AvailsWireModel):
         default=None,
         alias="guaranteedImpressions",
         ge=0,
-        description="Present ONLY for PG-capable products (policy 3); "
-        "omitted otherwise.",
+        description="Present ONLY for PG-capable products (policy 3); omitted otherwise.",
     )
     estimated_cpm: float = Field(
         alias="estimatedCpm",
@@ -288,28 +285,22 @@ class ProductTargeting(AvailsWireModel):
         "Investment, or Prohibitions."
     )
     type: TargetingUnit = Field(
-        description="How it is quantified: Frames, Audience, Investment, "
-        "or Total."
+        description="How it is quantified: Frames, Audience, Investment, or Total."
     )
     datasource: str = Field(
         max_length=255,
         description="Data source that defines the target vocabulary "
         "(third-party schemas welcome by design).",
     )
-    target: str = Field(
-        max_length=255, description="The targeted metric within datasource."
-    )
+    target: str = Field(max_length=255, description="The targeted metric within datasource.")
     target_values: list[str] = Field(
         alias="targetvalues",
         description="One or more values for the target (strings on the wire).",
     )
     selectable: bool = Field(
-        description="Whether a buyer may select from targetvalues or the "
-        "values are fixed."
-    )
-    count: float | None = Field(
-        default=None, description="Count of targetvalues."
+        description="Whether a buyer may select from targetvalues or the values are fixed."
     )
+    count: float | None = Field(default=None, description="Count of targetvalues.")
     minimum: float | None = Field(
         default=None, description="Minimum number of selectable targetvalues."
     )
@@ -328,17 +319,12 @@ class ProductTargeting(AvailsWireModel):
 class AvailsStatus(AvailsWireModel):
     """Spec ``Object: AvailsStatus`` — availability grouping for a product."""
 
-    status: AvailsStatusValue = Field(
-        description="Available, Partially Available, or Unavailable."
-    )
+    status: AvailsStatusValue = Field(description="Available, Partially Available, or Unavailable.")
     reason: AvailsStatusReason | None = Field(
         default=None,
-        description="Spec-enumerated reason when Partially Available or "
-        "Unavailable.",
-    )
-    comment: str | None = Field(
-        default=None, description="Free-text availability comment."
+        description="Spec-enumerated reason when Partially Available or Unavailable.",
     )
+    comment: str | None = Field(default=None, description="Free-text availability comment.")
     context: list[ProductTargeting] | None = Field(
         default=None,
         description="ProductTargeting entries describing the context of a "
@@ -364,19 +350,16 @@ class ProductAvailsSearch(AvailsWireModel):
     product_ids: list[str] = Field(
         alias="productids",
         min_length=1,
-        description="Products to get availability + pricing for "
-        "(spec-required, non-empty).",
+        description="Products to get availability + pricing for (spec-required, non-empty).",
     )
     targeting: list[dict[str, Any]] | None = Field(
         default=None,
-        description="AdCOM Segment object array "
-        '({"name": <dimension>, "value": <value>}).',
+        description='AdCOM Segment object array ({"name": <dimension>, "value": <value>}).',
     )
     product_targeting: list[ProductTargeting] | None = Field(
         default=None,
         alias="producttargeting",
-        description="ProductTargeting entries to target for the "
-        "availability request.",
+        description="ProductTargeting entries to target for the availability request.",
     )
     account_id: str = Field(
         alias="accountid",
@@ -384,9 +367,7 @@ class ProductAvailsSearch(AvailsWireModel):
         description="Account identifying the buyer, advertiser, and other "
         "stakeholders (spec-required).",
     )
-    currency: str | None = Field(
-        default=None, max_length=3, description="ISO-4217 currency code."
-    )
+    currency: str | None = Field(default=None, max_length=3, description="ISO-4217 currency code.")
     advertiser_brand_id: str = Field(
         alias="advertiserbrandid",
         max_length=36,
@@ -399,8 +380,7 @@ class ProductAvailsSearch(AvailsWireModel):
     )
     grouping: list[ProductTargeting] | None = Field(
         default=None,
-        description="ProductTargeting metrics the availability output is "
-        "grouped by.",
+        description="ProductTargeting metrics the availability output is grouped by.",
     )
     start_date: datetime = Field(
         alias="startdate", description="Desired delivery start (ISO-8601)."
@@ -471,8 +451,7 @@ class Avails(AvailsWireModel):
     product_id: str = Field(
         alias="productid",
         max_length=36,
-        description="Product the availability + pricing is for "
-        "(spec-required).",
+        description="Product the availability + pricing is for (spec-required).",
     )
     account_id: str = Field(
         alias="accountid",
@@ -487,12 +466,9 @@ class Avails(AvailsWireModel):
     avails_status: AvailsStatus | None = Field(
         default=None,
         alias="availsstatus",
-        description="Availability grouping (Available / Partially "
-        "Available / Unavailable).",
-    )
-    currency: str | None = Field(
-        default=None, max_length=3, description="ISO-4217 currency code."
+        description="Availability grouping (Available / Partially Available / Unavailable).",
     )
+    currency: str | None = Field(default=None, max_length=3, description="ISO-4217 currency code.")
     price: float = Field(
         description="The product's price (spec-required; OpenDirect 2.1 "
         "float dialect, FD-11 exception)."
@@ -539,9 +515,7 @@ class AvailsCollection(AvailsWireModel):
     (one record per requested product; empty when nothing matches).
     """
 
-    avails: list[Avails] = Field(
-        description="One Avails record per product in the request."
-    )
+    avails: list[Avails] = Field(description="One Avails record per product in the request.")
 
 
 # ---------------------------------------------------------------------------
@@ -598,9 +572,7 @@ def _legacy_request_to_spec(
             values = request.targeting[name]
             if not isinstance(values, list):
                 values = [values]
-            targeting.extend(
-                {"name": name, "value": str(value)} for value in values
-            )
+            targeting.extend({"name": name, "value": str(value)} for value in values)
         targeting = targeting or None
 
     return ProductAvailsSearch(
diff --git a/src/iab_agentic_primitives/protocol/catalog.py b/src/iab_agentic_primitives/protocol/catalog.py
index c1e6b43..6b4c777 100644
--- a/src/iab_agentic_primitives/protocol/catalog.py
+++ b/src/iab_agentic_primitives/protocol/catalog.py
@@ -38,12 +38,8 @@ class ProductListRequest(WireModel):
     ``$skip``/``$top`` query convention.
     """
 
-    limit: int = Field(
-        default=50, ge=1, le=500, description="Maximum products to return."
-    )
-    offset: int = Field(
-        default=0, ge=0, description="Zero-based index of the first product."
-    )
+    limit: int = Field(default=50, ge=1, le=500, description="Maximum products to return.")
+    offset: int = Field(default=0, ge=0, description="Zero-based index of the first product.")
 
 
 class ProductListResponse(WireModel):
diff --git a/src/iab_agentic_primitives/protocol/negotiation.py b/src/iab_agentic_primitives/protocol/negotiation.py
index 4f1a79d..a9ca665 100644
--- a/src/iab_agentic_primitives/protocol/negotiation.py
+++ b/src/iab_agentic_primitives/protocol/negotiation.py
@@ -95,9 +95,7 @@ class NegotiationMessage(IdempotentRequest):
     proposal_id: str | None = Field(
         default=None, description="Proposal under negotiation, if proposal-led."
     )
-    quote_id: str | None = Field(
-        default=None, description="Quote under negotiation, if quote-led."
-    )
+    quote_id: str | None = Field(default=None, description="Quote under negotiation, if quote-led.")
     round_number: int | None = Field(
         default=None,
         ge=1,
@@ -117,9 +115,7 @@ class NegotiationMessage(IdempotentRequest):
     @model_validator(mode="after")
     def _consistency(self) -> "NegotiationMessage":
         if self.negotiation_id is None and self.proposal_id is None and self.quote_id is None:
-            raise ValueError(
-                "NegotiationMessage requires negotiation_id, proposal_id, or quote_id"
-            )
+            raise ValueError("NegotiationMessage requires negotiation_id, proposal_id, or quote_id")
         if self.action in PRICED_ACTIONS and self.buyer_price is None:
             raise ValueError(f"action '{self.action.value}' requires buyer_price")
         if self.action is NegotiationAction.REJECT and self.buyer_price is not None:
diff --git a/src/iab_agentic_primitives/py.typed b/src/iab_agentic_primitives/py.typed
new file mode 100644
index 0000000..e69de29
diff --git a/src/iab_agentic_primitives/registry_client.py b/src/iab_agentic_primitives/registry_client.py
index 5bece33..5a4de99 100644
--- a/src/iab_agentic_primitives/registry_client.py
+++ b/src/iab_agentic_primitives/registry_client.py
@@ -398,7 +398,9 @@ async def verify_health(self, agent_id: int | str) -> dict[str, Any]:
 
     async def validate_domain(self, domain: str) -> DomainValidation:
         """Validate domain ownership (``POST /api/agents/validate/domain``, public)."""
-        response = await self._request("POST", f"{API_AGENTS}/validate/domain", json={"domain": domain})
+        response = await self._request(
+            "POST", f"{API_AGENTS}/validate/domain", json={"domain": domain}
+        )
         payload = response.json()
         return DomainValidation.model_validate(payload)
 
diff --git a/src/iab_agentic_primitives/sandbox_registry/real_double.py b/src/iab_agentic_primitives/sandbox_registry/real_double.py
index b810e81..0760fb6 100644
--- a/src/iab_agentic_primitives/sandbox_registry/real_double.py
+++ b/src/iab_agentic_primitives/sandbox_registry/real_double.py
@@ -94,8 +94,12 @@ def _error(status: int, message: str, refresh: str | None = None) -> JSONRespons
 
 
 def _normalize_domain(domain: str) -> str:
-    return domain.lower().replace("https://", "").replace("http://", "").rstrip("/").removeprefix(
-        "www."
+    return (
+        domain.lower()
+        .replace("https://", "")
+        .replace("http://", "")
+        .rstrip("/")
+        .removeprefix("www.")
     )
 
 
@@ -278,7 +282,11 @@ async def validate_domain(request: Request) -> Response:
             return _error(400, "Domain is required")
         norm = _normalize_domain(domain)
         match = next(
-            (a for a in store.agents.values() if _normalize_domain(a.get("primary_domain", "")) == norm),
+            (
+                a
+                for a in store.agents.values()
+                if _normalize_domain(a.get("primary_domain", "")) == norm
+            ),
             None,
         )
         if match:
@@ -326,13 +334,16 @@ async def validate_agent(request: Request) -> Response:
     def verification_badge(agent_id: int) -> Response:
         agent = store.agents.get(agent_id)
         if agent is None:
-            return Response(content=_error_badge("Agent Not Found"), status_code=404,
-                            media_type="image/svg+xml")
+            return Response(
+                content=_error_badge("Agent Not Found"), status_code=404, media_type="image/svg+xml"
+            )
         if not agent.get("iab_member"):
-            return Response(content=_error_badge("Not Verified"), status_code=404,
-                            media_type="image/svg+xml")
-        return Response(content=_verified_badge(agent.get("agent_name", "Unknown")),
-                        media_type="image/svg+xml")
+            return Response(
+                content=_error_badge("Not Verified"), status_code=404, media_type="image/svg+xml"
+            )
+        return Response(
+            content=_verified_badge(agent.get("agent_name", "Unknown")), media_type="image/svg+xml"
+        )
 
     return app
 
diff --git a/src/iab_agentic_primitives/web_bot_auth/__init__.py b/src/iab_agentic_primitives/web_bot_auth/__init__.py
new file mode 100644
index 0000000..d84cc71
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/__init__.py
@@ -0,0 +1,179 @@
+"""Web Bot Auth profile: signed agent-to-agent HTTP messages and key discovery.
+
+An identity is an origin ``https://<host>``. A signer names its signed key
+directory, ``https://<host>/.well-known/http-message-signatures-directory``, in a
+covered ``Signature-Agent`` member, and a verifier fetches the signer's keys
+from that URL. A verifier also accepts the bare origin, the draft -00 form.
+Requests carry one ``web-bot-auth`` signature with a nonce; responses carry one
+bound to the request they answer. WEB_BOT_AUTH.md at the repository root states
+the rules.
+
+The library confirms a signature and returns a :class:`VerifiedRequest` or a
+:class:`VerifiedResponse`; the caller maps its ``origin`` to the principal in
+its own records.
+
+Modules:
+
+- :mod:`.values`: :class:`Origin`, :class:`ServerIdentity`, key ids, and time.
+- :mod:`.rules`: the profile's rules, stated once, and :func:`accept_signature`.
+- :mod:`.errors`: :class:`Refusal`, :class:`WebBotAuthError`,
+  :class:`ConfigurationError`, and :class:`SigningError`.
+- :mod:`.presentation`: :func:`refusal_response`, a refusal as an HTTP response.
+- :mod:`.keys`: :class:`Ed25519Key` and JWK thumbprints.
+- :mod:`.directory`: :func:`publish_directory`, :class:`DirectoryPublisher`,
+  and :func:`verify_directory`, with :class:`DirectoryResponse`,
+  :class:`KeySet`, and :class:`VerifiedDirectory`.
+- :mod:`.ports`: :class:`KeyResolver`, :class:`DirectoryFetcher`, and
+  :class:`DirectoryStore`.
+- :mod:`.resolver`: :class:`DirectoryResolver`, :class:`MemoryDirectoryStore`,
+  and :class:`StaticKeyResolver`.
+- :mod:`.fetcher`: :class:`~.fetcher.HttpxDirectoryFetcher`, the default fetcher.
+- :mod:`.replay`: the :class:`NonceStore` protocol and :class:`MemoryNonceStore`.
+- :mod:`.signer`: :class:`RequestSigner` and :class:`ResponseSigner`.
+- :mod:`.verifier`: :class:`RequestVerifier` and :class:`ResponseVerifier`.
+- :mod:`.roles`: the role ports the edges take, :class:`RequestConfirmer`,
+  :class:`ResponseConfirmer`, :class:`RequestSigning`, and :class:`ResponseSigning`.
+- :mod:`.httpx`: :class:`WebBotAuth`, which builds httpx clients that sign
+  each wire hop and verify each signed response.
+- :mod:`.sync`: :class:`~.sync.SyncRuntime`, the one event loop synchronous code
+  verifies on, and the sync façades.
+- :mod:`.asgi`: response signing, the directory route, and an opt-in verifier.
+- :mod:`.testing`: :func:`~.testing.directory_transport`, directories served from data.
+- :mod:`.conformance`: the vectors and a runner. It alone imports the private
+  raw signer, which signs what the profile refuses.
+
+Requires the ``wba`` extra: ``pip install 'iab-agentic-primitives[wba]'``.
+"""
+
+# The guard runs first: without the extra, nothing below is imported.
+from .extra import EXTRA_MODULES
+
+# isort: split
+from .directory import (
+    DirectoryPublisher,
+    DirectoryResponse,
+    FetchLimits,
+    KeySet,
+    PublishPolicy,
+    VerifiedDirectory,
+    publish_directory,
+    verify_directory,
+)
+from .errors import ConfigurationError, Refusal, SigningError, WebBotAuthError
+from .keys import Ed25519Key, thumbprint
+from .message import Answer, HeaderLines, Headers, HTTPRequest, HTTPResponse, target_uri
+from .ports import (
+    DirectoryFetcher,
+    DirectoryStore,
+    DirectoryStoreUnavailable,
+    KeyResolver,
+    ResolvedKey,
+)
+from .presentation import refusal_response
+from .replay import MemoryNonceStore, NonceStore, NonceStoreUnavailable
+from .resolver import CachePolicy, DirectoryResolver, MemoryDirectoryStore, StaticKeyResolver
+from .roles import RequestConfirmer, RequestSigning, ResponseConfirmer, ResponseSigning
+from .rules import (
+    ALGORITHM,
+    CLOCK_SKEW,
+    DIRECTORY_TAG,
+    MAX_LIFETIME,
+    SIGNATURE_TAG,
+    accept_signature,
+)
+from .signer import RequestSigner, ResponseSigner
+from .values import (
+    DIRECTORY_MEDIA_TYPE,
+    DIRECTORY_PATH,
+    Authority,
+    Clock,
+    KeyId,
+    Origin,
+    RequestAuthority,
+    Seconds,
+    ServerIdentity,
+    TargetURI,
+    UnixSeconds,
+    system_clock,
+)
+from .verifier import (
+    CONFORMANCE_KEYS,
+    SAME_ORIGIN,
+    ExpectedOrigin,
+    KeyPolicy,
+    RequestVerifier,
+    ResponseVerifier,
+    VerifiedRequest,
+    VerifiedResponse,
+    is_signed,
+)
+
+__all__ = [
+    "ALGORITHM",
+    "CLOCK_SKEW",
+    "CONFORMANCE_KEYS",
+    "DIRECTORY_MEDIA_TYPE",
+    "DIRECTORY_PATH",
+    "DIRECTORY_TAG",
+    "EXTRA_MODULES",
+    "MAX_LIFETIME",
+    "SAME_ORIGIN",
+    "SIGNATURE_TAG",
+    "Answer",
+    "Authority",
+    "CachePolicy",
+    "Clock",
+    "ConfigurationError",
+    "DirectoryFetcher",
+    "DirectoryPublisher",
+    "DirectoryResolver",
+    "DirectoryResponse",
+    "DirectoryStore",
+    "DirectoryStoreUnavailable",
+    "Ed25519Key",
+    "ExpectedOrigin",
+    "FetchLimits",
+    "HTTPRequest",
+    "HTTPResponse",
+    "HeaderLines",
+    "Headers",
+    "KeyId",
+    "KeyPolicy",
+    "KeyResolver",
+    "KeySet",
+    "MemoryDirectoryStore",
+    "MemoryNonceStore",
+    "NonceStore",
+    "NonceStoreUnavailable",
+    "Origin",
+    "PublishPolicy",
+    "Refusal",
+    "RequestAuthority",
+    "RequestConfirmer",
+    "RequestSigner",
+    "RequestSigning",
+    "RequestVerifier",
+    "ResolvedKey",
+    "ResponseConfirmer",
+    "ResponseSigner",
+    "ResponseSigning",
+    "ResponseVerifier",
+    "Seconds",
+    "ServerIdentity",
+    "SigningError",
+    "StaticKeyResolver",
+    "TargetURI",
+    "UnixSeconds",
+    "VerifiedDirectory",
+    "VerifiedRequest",
+    "VerifiedResponse",
+    "WebBotAuthError",
+    "accept_signature",
+    "is_signed",
+    "publish_directory",
+    "refusal_response",
+    "system_clock",
+    "target_uri",
+    "thumbprint",
+    "verify_directory",
+]
diff --git a/src/iab_agentic_primitives/web_bot_auth/_sig.py b/src/iab_agentic_primitives/web_bot_auth/_sig.py
new file mode 100644
index 0000000..edf0987
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/_sig.py
@@ -0,0 +1,310 @@
+"""The RFC 9421 seam: signature base construction and Ed25519, from http-message-signatures.
+
+The profile modules decide what to sign and what to accept. This module asks
+``http_message_signatures`` to build the signature base and to sign or verify
+it, so the base is the library's, not a copy of it. It takes and returns the
+module's own types: a message goes in as :class:`HTTPRequest` or
+:class:`HTTPResponse`, and every library error comes out as
+:class:`SigningError` on sign or a refusal on verify.
+"""
+
+from __future__ import annotations
+
+import datetime
+from collections.abc import Iterable, Iterator, Sequence
+from dataclasses import dataclass, replace
+from typing import Literal
+
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+from http_message_signatures import (
+    HTTPMessageSigner,
+    HTTPMessageVerifier,
+    HTTPSignatureComponentResolver,
+    MappingKeyResolver,
+    algorithms,
+)
+from http_message_signatures import VerifyResult as _LibraryResult
+from http_message_signatures.exceptions import HTTPMessageSignaturesException
+
+from ._wire import ComponentId, SignatureMember, only_member, signature_values
+from .errors import Refusal, SigningError, refuse
+from .keys import Ed25519Key
+from .message import HeaderLines, HTTPRequest, HTTPResponse
+from .values import OMIT, KeyId, Omit, TargetURI, UnixSeconds
+
+#: Whether a signature replaces the message's signatures or joins them.
+Mode = Literal["replace", "append"]
+
+#: The library's identifier of the one algorithm the key signs with.
+_ED25519: str = algorithms.ED25519.algorithm_id
+
+
+@dataclass(frozen=True, slots=True)
+class SignatureParams:
+    """What one signature covers and the parameters it carries.
+
+    ``alg`` is the value written to the ``alg`` parameter. The key always
+    signs Ed25519, so any other value is a claim the profile refuses.
+    """
+
+    label: str
+    components: tuple[ComponentId, ...]
+    created: UnixSeconds
+    keyid: KeyId
+    expires: UnixSeconds | Literal[Omit.OMIT] = OMIT
+    nonce: str | Literal[Omit.OMIT] = OMIT
+    tag: str | Literal[Omit.OMIT] = OMIT
+    alg: str | Literal[Omit.OMIT] = _ED25519
+
+
+@dataclass(frozen=True, slots=True)
+class VerifyResult:
+    """What the library authenticated for one signature.
+
+    ``created``, ``expires``, ``nonce``, and ``keyid`` are the signed
+    parameters, and ``components`` the covered component identifiers.
+    ``body`` is the body bytes when a covered ``Content-Digest`` matched them,
+    and ``None`` when the signature doesn't cover the body.
+    ``signature_base`` is the base the signature signs (RFC 9421 section 2.5).
+    """
+
+    label: str
+    keyid: KeyId
+    created: UnixSeconds
+    expires: UnixSeconds
+    nonce: str | None
+    components: tuple[ComponentId, ...]
+    body: bytes | None
+    signature_base: bytes
+
+
+# ── the library's message protocol ────────────────────────────────────────
+
+
+class _FieldLines:
+    """The mutable field lines ``http_message_signatures`` reads and writes while it signs."""
+
+    def __init__(self, lines: Iterable[tuple[str, str]]) -> None:
+        self._lines = list(lines)
+
+    def items(self) -> list[tuple[str, str]]:
+        return list(self._lines)
+
+    def __iter__(self) -> Iterator[str]:
+        return iter(dict.fromkeys(name for name, _ in self._lines))
+
+    def __contains__(self, name: object) -> bool:
+        return isinstance(name, str) and any(n.lower() == name.lower() for n, _ in self._lines)
+
+    def __setitem__(self, name: str, value: str) -> None:
+        self._lines.append((name, value))
+
+    def __delitem__(self, name: str) -> None:
+        self._lines = [(n, v) for n, v in self._lines if n.lower() != name.lower()]
+
+
+@dataclass
+class _RequestView:
+    """A request as the library reads it, with the profile's :class:`TargetURI`.
+
+    ``url`` is the scheme and authority alone, which the library's strict URL
+    grammar checks; :class:`_ProfileComponents` takes the path and query from
+    ``target``.
+    """
+
+    method: str
+    url: str
+    headers: _FieldLines
+    target: TargetURI
+
+
+@dataclass
+class _ResponseView:
+    status_code: int
+    headers: _FieldLines
+    request: _RequestView
+
+
+class _ProfileComponents(HTTPSignatureComponentResolver):
+    """The library's component resolver, reading the request URL the profile owns.
+
+    The library parses a request's ``url`` in its constructor with the strict
+    RFC 3986 grammar, which refuses what clients send raw, such as ``[ ] |
+    ^ { }`` in a query, and it takes no parsed parts. ``component_resolver_class``
+    is its extension point, so this subclass is the smallest seam: the
+    library checks the scheme and authority, and its parsed parts then take
+    the profile's path and query. Every derived component the library
+    resolves, ``@target-uri`` and ``@authority`` alike, comes from one
+    :class:`TargetURI`.
+    """
+
+    def __init__(self, message: _RequestView | _ResponseView) -> None:
+        super().__init__(message)  # type: ignore[no-untyped-call]  # the library leaves it untyped
+        if isinstance(message, _RequestView):
+            target = message.target
+            self.url_parts = replace(self.url_parts, path=target.path, query=target.query)
+
+
+def _request_view(request: HTTPRequest) -> _RequestView:
+    """The library's view of ``request``; its URL is the one place a URL enters a signature base.
+
+    Raises ``ValueError`` when the URL isn't an absolute ``http`` or ``https`` URL.
+    """
+    target = TargetURI.parse(request.url)
+    origin = f"{target.scheme}://{target.authority}"
+    return _RequestView(request.method.upper(), origin, _FieldLines(request.headers), target)
+
+
+def _view(message: HTTPRequest | HTTPResponse) -> _RequestView | _ResponseView:
+    if isinstance(message, HTTPResponse):
+        return _ResponseView(
+            message.status, _FieldLines(message.headers), _request_view(message.request)
+        )
+    return _request_view(message)
+
+
+# ── signing ───────────────────────────────────────────────────────────────
+
+
+def _algorithm(alg: str | Omit) -> type[algorithms.HTTPSignatureAlgorithm]:
+    """Ed25519, labelled ``alg`` when the parameters claim another value."""
+    if alg is OMIT or alg == _ED25519:
+        return algorithms.ED25519
+    return type("ClaimedAlgorithm", (algorithms.ED25519,), {"algorithm_id": alg})
+
+
+def _utc(seconds: UnixSeconds) -> datetime.datetime:
+    return datetime.datetime.fromtimestamp(seconds, tz=datetime.UTC)
+
+
+def signed[M: (HTTPRequest, HTTPResponse)](
+    message: M, key: Ed25519Key, params: SignatureParams, *, mode: Mode
+) -> M:
+    """``message`` signed with ``key`` under ``params``: the one signing call.
+
+    ``mode="append"`` keeps the signatures already on the message, and
+    ``"replace"`` drops them. ``Signature-Input`` and ``Signature`` are placed
+    last, as the library places them. The caller's message is unchanged.
+    Raises :class:`SigningError` when the library can't sign the message, for
+    example when a request URL isn't absolute or a covered field is absent.
+    """
+    try:
+        view = _view(message)
+    except ValueError as e:
+        raise SigningError(f"the message can't be signed: {e}") from e
+    signer = HTTPMessageSigner(
+        signature_algorithm=_algorithm(params.alg), component_resolver_class=_ProfileComponents
+    )
+    try:
+        prepared = signer.prepare(
+            view,
+            key_id=params.keyid,
+            created=_utc(params.created),
+            expires=None if params.expires is OMIT else _utc(params.expires),
+            nonce=None if params.nonce is OMIT else params.nonce,
+            label=params.label,
+            tag=None if params.tag is OMIT else params.tag,
+            include_alg=params.alg is not OMIT,
+            covered_component_ids=[str(c) for c in params.components],
+            # The profile adds Content-Digest itself; the library reuses it and never adds one.
+            use_existing_digest="content-digest" in message.headers,
+        )
+        signer.apply(
+            view,
+            prepared,
+            key.sign(prepared.signature_base),
+            append_if_signature_exists=mode == "append",
+        )
+    except HTTPMessageSignaturesException as e:
+        raise SigningError(f"the message can't be signed: {e}") from e
+    signature_input, signature = signature_values(HeaderLines(view.headers.items()))
+    lines = message.headers.with_replaced("Signature-Input", signature_input)
+    return replace(message, headers=lines.with_replaced("Signature", signature))
+
+
+def signed_by_each[M: (HTTPRequest, HTTPResponse)](
+    message: M, signers: Sequence[tuple[Ed25519Key, SignatureParams]]
+) -> M:
+    """``message`` signed once by each key, in order, each signature kept beside the others."""
+    for i, (key, params) in enumerate(signers):
+        message = signed(message, key, params, mode="append" if i else "replace")
+    return message
+
+
+# ── verifying ─────────────────────────────────────────────────────────────
+
+
+class _ProfileClockVerifier(HTTPMessageVerifier):
+    """The library verifier, with the time window left to the profile."""
+
+    def validate_created_and_expires(self, sig_input: object, max_age: object = None) -> None:
+        """Skips the library's wall-clock check.
+
+        The profile checks ``created`` and ``expires`` against its injected
+        clock before it calls :func:`verify`, so neither argument is read here.
+        """
+
+
+def _result(result: _LibraryResult, member: SignatureMember) -> VerifyResult:
+    created, expires = result.parameters.get("created"), result.parameters.get("expires")
+    keyid = result.parameters.get("keyid")
+    if type(created) is not int or type(expires) is not int or not isinstance(keyid, str):
+        raise refuse(
+            Refusal.SIGNATURE_INVALID,
+            f"signature {result.label} doesn't sign created, expires, and keyid",
+        )
+    # The library's covered components end with "@signature-params": they are the base's lines.
+    base = "\n".join(f"{k}: {v}" for k, v in result.covered_components.items()).encode()
+    return VerifyResult(
+        result.label,
+        KeyId(keyid),
+        UnixSeconds(created),
+        UnixSeconds(expires),
+        result.nonce,
+        member.components,
+        result.body,
+        base,
+    )
+
+
+def verify(
+    message: HTTPRequest | HTTPResponse,
+    member: SignatureMember,
+    public_key: Ed25519PublicKey,
+    *,
+    require_components: Sequence[ComponentId],
+    body: bytes | None,
+) -> VerifyResult:
+    """Verifies the signature ``member`` names, with ``public_key``.
+
+    The library checks that the signature covers ``require_components`` and,
+    given ``body``, that the signature covers ``Content-Digest`` and the digest
+    matches ``body``. Pass ``body=None`` only when the signature doesn't cover
+    the body. Raises a ``signature-invalid`` refusal on any failure.
+    """
+    if member.keyid is None or member.tag is None:
+        raise refuse(Refusal.SIGNATURE_INVALID, f"signature {member.label} has no keyid or tag")
+    verifier = _ProfileClockVerifier(
+        signature_algorithm=algorithms.ED25519,
+        key_resolver=MappingKeyResolver(public_keys={member.keyid: public_key}, private_keys={}),
+        component_resolver_class=_ProfileComponents,
+    )
+    try:
+        view = _view(replace(message, headers=only_member(message.headers, member.label)))
+    except ValueError as e:
+        raise refuse(Refusal.SIGNATURE_INVALID, f"signature {member.label}: {e}") from e
+    try:
+        results = verifier.verify(
+            view,
+            expect_tag=member.tag,
+            expect_label=member.label,
+            max_age=None,
+            require_components=[str(c) for c in require_components],
+            body=body,
+        )
+    except HTTPMessageSignaturesException as e:
+        raise refuse(
+            Refusal.SIGNATURE_INVALID, f"signature {member.label} does not verify: {e}"
+        ) from e
+    # Labels are unique, and the library raises when none matches: one result.
+    return _result(results[0], member)
diff --git a/src/iab_agentic_primitives/web_bot_auth/_unchecked.py b/src/iab_agentic_primitives/web_bot_auth/_unchecked.py
new file mode 100644
index 0000000..64889f7
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/_unchecked.py
@@ -0,0 +1,67 @@
+"""Raw signing, for the conformance vectors and scenarios only.
+
+The profile's signers sign what the profile requires, and nothing else: they
+take no parameter that departs from it. A conformance vector has to sign what
+the profile refuses, such as another ``alg``, a missing nonce, an uncovered
+member, or a directory signed for another authority. This module signs a
+message with a finished :class:`SignatureParams` and nothing checked, so a
+verifier can be shown each of those.
+
+Only :mod:`.conformance` imports it, and an import contract keeps it that
+way. The package doesn't export it. A production signer never needs it.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Sequence
+
+from . import _sig
+from ._sig import Mode, SignatureParams
+from ._wire import content_digest, parse_signature_fields
+from .keys import Ed25519Key
+from .message import HTTPRequest, HTTPResponse
+
+
+def sign_unchecked[M: (HTTPRequest, HTTPResponse)](
+    message: M, key: Ed25519Key, params: SignatureParams, *, mode: Mode = "replace"
+) -> M:
+    """``message`` signed by ``key`` under ``params``, whatever they are.
+
+    The header lines the signature covers, such as ``Signature-Agent`` and
+    ``Content-Digest``, must already be on ``message``. ``mode="append"``
+    keeps the signatures already there.
+    """
+    return _sig.signed(message, key, params, mode=mode)
+
+
+def sign_each_unchecked[M: (HTTPRequest, HTTPResponse)](
+    message: M, signers: Sequence[tuple[Ed25519Key, SignatureParams]]
+) -> M:
+    """``message`` signed once by each key under its own parameters, as a directory is."""
+    return _sig.signed_by_each(message, signers)
+
+
+def signature_base(message: HTTPRequest | HTTPResponse, label: str, key: Ed25519Key) -> bytes:
+    """The signature base of the signature ``label`` on ``message`` (RFC 9421 section 2.5).
+
+    The signature must verify with ``key``. The conformance vectors publish
+    the base, so an implementation can compare its own before it compares
+    signatures. Raises :class:`WebBotAuthError` when the signature doesn't
+    parse or verify.
+    """
+    fields = parse_signature_fields(message.headers)
+    if fields is None:
+        raise ValueError("the message carries no Signature-Input")
+    return _sig.verify(
+        message, fields[label], key.public_key, require_components=(), body=None
+    ).signature_base
+
+
+__all__ = [
+    "Mode",
+    "SignatureParams",
+    "content_digest",
+    "sign_each_unchecked",
+    "sign_unchecked",
+    "signature_base",
+]
diff --git a/src/iab_agentic_primitives/web_bot_auth/_wire.py b/src/iab_agentic_primitives/web_bot_auth/_wire.py
new file mode 100644
index 0000000..bb3d05e
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/_wire.py
@@ -0,0 +1,402 @@
+"""The Structured Fields and Content-Digest seam, from http-sf and http-message-signatures.
+
+The profile modules read ``Signature-Input``, ``Signature``, ``Signature-Agent``,
+and ``Content-Digest`` only through this module, and get typed values back:
+
+- :func:`is_signed` is the one test of whether a message is signed: it carries
+  ``Signature-Input``, so the profile's verification steps apply to it.
+- :func:`parse_signature_fields` parses the three signature fields of a signed
+  message once, under one duplicate-key policy, into :class:`SignatureFields`.
+- :func:`check_content_digest` checks a ``Content-Digest`` against the body.
+- :class:`ComponentId` is a covered component identifier.
+
+Only ``http_sf.StructuredFieldError`` and the library's digest error are
+caught; anything else is a bug and propagates.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Iterator, Mapping
+from dataclasses import dataclass
+from types import MappingProxyType
+
+import http_sf
+from http_message_signatures import ContentDigest
+from http_message_signatures.exceptions import HTTPMessageSignaturesException
+from http_sf.types import ParamsType
+
+from .errors import Refusal, refuse
+from .message import HeaderLines
+from .values import KeyId, UnixSeconds
+
+#: A component parameter value: ``req``, ``sf``, and ``bs`` are Booleans, and
+#: ``key`` and ``name`` are Strings (RFC 9421 section 2.1).
+ComponentParam = str | bool
+
+
+@dataclass(frozen=True, slots=True, eq=False)
+class ComponentId:
+    """A covered component identifier, such as ``"signature-agent";key="sig1"``.
+
+    ``params`` keeps the order the identifier was written in, which
+    ``str(component)`` serializes. Two identifiers are equal when their names
+    and parameters are, in any order (RFC 9421 section 2).
+    """
+
+    name: str
+    params: tuple[tuple[str, ComponentParam], ...] = ()
+
+    def _identity(self) -> tuple[str, frozenset[tuple[str, ComponentParam]]]:
+        return self.name, frozenset(self.params)
+
+    def __eq__(self, other: object) -> bool:
+        return isinstance(other, ComponentId) and self._identity() == other._identity()
+
+    def __hash__(self) -> int:
+        return hash(self._identity())
+
+    def __str__(self) -> str:
+        params: ParamsType = dict(self.params)
+        return http_sf.ser((self.name, params))
+
+
+def component_id(name: str, params: Mapping[str, ComponentParam] | None = None) -> ComponentId:
+    """The component identifier ``name`` with ``params``, in the order given."""
+    return ComponentId(name, tuple((params or {}).items()))
+
+
+@dataclass(frozen=True, slots=True)
+class SignatureMember:
+    """One ``Signature-Input`` member: its label, covered components, and parameters.
+
+    A parameter the member doesn't carry is ``None``. The parser checks each
+    parameter's type (RFC 9421 section 2.3); which parameters are required
+    is the profile's rule, not the parser's.
+    """
+
+    label: str
+    components: tuple[ComponentId, ...]
+    created: UnixSeconds | None
+    expires: UnixSeconds | None
+    keyid: KeyId | None
+    alg: str | None
+    nonce: str | None
+    tag: str | None
+
+
+@dataclass(frozen=True, slots=True)
+class SignatureAgentMember:
+    """One ``Signature-Agent`` member. ``value`` is ``None`` when it isn't a String."""
+
+    label: str
+    value: str | None
+    has_parameters: bool
+
+
+class SignatureFields(Mapping[str, SignatureMember]):
+    """The parsed signature fields of one message: an immutable mapping from label
+    to :class:`SignatureMember`, in ``Signature-Input`` order.
+
+    ``signatures`` maps each ``Signature`` label to its Byte Sequence, and
+    ``agents`` maps each ``Signature-Agent`` label to its member. A label
+    repeated in a field parses, and RFC 9651 keeps its last value:
+    ``repeated`` holds the labels repeated in ``Signature-Input`` or
+    ``Signature``, and ``repeated_agents`` those repeated in
+    ``Signature-Agent``. Only a repeat of the member a verifier selects makes
+    that member ambiguous, so the selection refuses it, not the parse.
+    """
+
+    __slots__ = ("_members", "agents", "repeated", "repeated_agents", "signatures")
+
+    def __init__(
+        self,
+        members: Mapping[str, SignatureMember],
+        signatures: Mapping[str, bytes],
+        agents: Mapping[str, SignatureAgentMember],
+        *,
+        repeated: frozenset[str] = frozenset(),
+        repeated_agents: frozenset[str] = frozenset(),
+    ) -> None:
+        self._members = MappingProxyType(dict(members))
+        self.signatures: Mapping[str, bytes] = MappingProxyType(dict(signatures))
+        self.agents: Mapping[str, SignatureAgentMember] = MappingProxyType(dict(agents))
+        self.repeated = repeated
+        self.repeated_agents = repeated_agents
+
+    def __getitem__(self, label: str) -> SignatureMember:
+        return self._members[label]
+
+    def __iter__(self) -> Iterator[str]:
+        return iter(self._members)
+
+    def __len__(self) -> int:
+        return len(self._members)
+
+    def one_tagged(self, tag: str) -> SignatureMember:
+        """The one member tagged ``tag``, which has a ``Signature`` member too.
+
+        This is the one selection of a signature by its tag. Refuses
+        ``signature-missing`` when there is no such member or its
+        ``Signature`` member is absent, and ``multiple-signatures`` when there
+        is more than one or its label is repeated. A repeated label on any
+        other member is not this member's concern.
+        """
+        tagged = [m for m in self._members.values() if m.tag == tag]
+        if not tagged:
+            raise refuse(Refusal.SIGNATURE_MISSING, f"the message carries no {tag} signature")
+        if len(tagged) > 1:
+            raise refuse(
+                Refusal.MULTIPLE_SIGNATURES,
+                f"{len(tagged)} {tag} signatures; the profile takes one",
+            )
+        label = tagged[0].label
+        if label in self.repeated:
+            raise refuse(Refusal.MULTIPLE_SIGNATURES, f"signature member {label} is repeated")
+        if label not in self.signatures:
+            raise refuse(Refusal.SIGNATURE_MISSING, f"Signature has no member {label}")
+        return tagged[0]
+
+
+# ── parsing ───────────────────────────────────────────────────────────────
+
+
+@dataclass(frozen=True, slots=True)
+class _Dictionary:
+    members: Mapping[str, object]
+    repeated: tuple[str, ...]
+
+
+def _parse_dictionary(value: str) -> _Dictionary:
+    """Parses a Structured Field Dictionary.
+
+    A repeated parameter is a parse failure. A repeated dictionary key is not:
+    RFC 9651 keeps the last value, and the key is reported in ``repeated`` so
+    the caller can refuse it under its own rule. Raises ``StructuredFieldError``.
+    """
+    repeated: list[str] = []
+
+    def on_duplicate(key: str, context: str) -> None:
+        if context != "dictionary":
+            raise http_sf.StructuredFieldError(f"duplicate {context} key {key!r}")
+        repeated.append(key)
+
+    try:
+        data = value.encode("ascii")
+    except UnicodeEncodeError as e:
+        raise http_sf.StructuredFieldError("the field is not ASCII") from e
+    parsed = http_sf.parse(data, tltype="dictionary", on_duplicate_key=on_duplicate)
+    if not isinstance(parsed, dict):  # pragma: no cover - tltype="dictionary" returns a dict
+        raise http_sf.StructuredFieldError("the field is not a Dictionary")
+    return _Dictionary(parsed, tuple(repeated))
+
+
+def _field(lines: HeaderLines, name: str) -> _Dictionary:
+    value = lines.get(name)
+    if value is None:
+        return _Dictionary({}, ())
+    try:
+        return _parse_dictionary(value)
+    except http_sf.StructuredFieldError as e:
+        raise refuse(Refusal.PARSE, f"{name} does not parse: {e}") from e
+
+
+def _split(member: object) -> tuple[object, Mapping[str, object]]:
+    """A parsed member's value and parameters."""
+    if isinstance(member, tuple) and len(member) == 2 and isinstance(member[1], dict):
+        return member[0], member[1]
+    return member, {}
+
+
+def _component(label: str, item: object) -> ComponentId:
+    name, params = _split(item)
+    if not isinstance(name, str):
+        raise refuse(Refusal.PARSE, f"Signature-Input member {label} covers a non-String {name!r}")
+    checked: list[tuple[str, ComponentParam]] = []
+    for key, value in params.items():
+        if not isinstance(value, (str, bool)):
+            raise refuse(
+                Refusal.PARSE,
+                f"Signature-Input member {label}: component parameter {key} is {value!r}",
+            )
+        checked.append((key, value))
+    return ComponentId(name, tuple(checked))
+
+
+def _instant(label: str, params: Mapping[str, object], name: str) -> UnixSeconds | None:
+    value = params.get(name)
+    if value is None:
+        return None
+    if type(value) is not int:
+        raise refuse(Refusal.PARSE, f"Signature-Input member {label}: {name} is not an Integer")
+    return UnixSeconds(value)
+
+
+def _string(label: str, params: Mapping[str, object], name: str) -> str | None:
+    value = params.get(name)
+    if value is not None and not isinstance(value, str):
+        raise refuse(Refusal.PARSE, f"Signature-Input member {label}: {name} is not a String")
+    return value
+
+
+def _signature_member(label: str, member: object) -> SignatureMember:
+    items, params = _split(member)
+    # Every member's shape is checked whatever its tag (RFC 9421 sections 4.1 and 4.2).
+    if not isinstance(items, list):
+        raise refuse(Refusal.PARSE, f"Signature-Input member {label} is not an Inner List")
+    keyid = _string(label, params, "keyid")
+    return SignatureMember(
+        label=label,
+        components=tuple(_component(label, item) for item in items),
+        created=_instant(label, params, "created"),
+        expires=_instant(label, params, "expires"),
+        keyid=None if keyid is None else KeyId(keyid),
+        alg=_string(label, params, "alg"),
+        nonce=_string(label, params, "nonce"),
+        tag=_string(label, params, "tag"),
+    )
+
+
+def _signature(label: str, member: object) -> bytes:
+    value, _ = _split(member)
+    if not isinstance(value, bytes):
+        raise refuse(Refusal.PARSE, f"Signature member {label} is not a Byte Sequence")
+    return value
+
+
+def _agent(label: str, member: object) -> SignatureAgentMember:
+    value, params = _split(member)
+    return SignatureAgentMember(label, value if isinstance(value, str) else None, bool(params))
+
+
+def is_signed(lines: HeaderLines) -> bool:
+    """True when the message carries ``Signature-Input``: the one test of whether it is signed.
+
+    The profile's verification steps apply to a message that carries
+    ``Signature-Input`` and to no other. A message with only a ``Signature``
+    field, such as one from another signature scheme, is unsigned under the
+    profile, and its ``Signature`` is never parsed.
+    """
+    return "signature-input" in lines
+
+
+def parse_signature_fields(lines: HeaderLines) -> SignatureFields | None:
+    """Parses ``Signature-Input``, ``Signature``, and ``Signature-Agent`` once.
+
+    Returns ``None`` for a message that isn't signed (:func:`is_signed`), and
+    parses nothing. A signed message gets the profile's step 1: every member's
+    shape is checked, whatever its tag, and a failure refuses ``parse``
+    (``400``): a field that doesn't parse as a Dictionary, a repeated
+    parameter, a ``Signature-Input`` member that isn't an Inner List of
+    Strings with parameters of their RFC 9421 types, or a ``Signature``
+    member that isn't a Byte Sequence. The parse refuses nothing else: a
+    repeated label is carried on the result for the selection to judge.
+    """
+    if not is_signed(lines):
+        return None
+    inputs = _field(lines, "signature-input")
+    signatures = _field(lines, "signature")
+    agents = _field(lines, "signature-agent")
+    return SignatureFields(
+        {label: _signature_member(label, m) for label, m in inputs.members.items()},
+        {label: _signature(label, m) for label, m in signatures.members.items()},
+        {label: _agent(label, m) for label, m in agents.members.items()},
+        repeated=frozenset((*inputs.repeated, *signatures.repeated)),
+        repeated_agents=frozenset(agents.repeated),
+    )
+
+
+def only_member(lines: HeaderLines, label: str) -> HeaderLines:
+    """``lines`` with ``Signature-Input`` and ``Signature`` holding the member ``label`` alone.
+
+    A signature is verified from its own member (RFC 9421 section 3.2), and the
+    profile verifies no member with another tag. Left in, another signer's
+    member could fail the library's own parse, as a repeated label or a label
+    with no ``Signature`` member does, and refuse a valid signature. The
+    member is serialized again from its parse; the library serializes it
+    again for the signature base anyway. Lines with no other member are
+    returned as they are. Raises ``ValueError`` when the fields don't parse
+    or lack the member.
+    """
+    try:
+        inputs = _parse_dictionary(lines["signature-input"])
+        signatures = _parse_dictionary(lines["signature"])
+    except (KeyError, http_sf.StructuredFieldError) as e:
+        raise ValueError(f"the signature fields lack a member {label}: {e}") from e
+    alone = (label,)
+    if (tuple(inputs.members), tuple(signatures.members)) == (alone, alone) and not (
+        inputs.repeated or signatures.repeated
+    ):
+        return lines
+    if label not in inputs.members or label not in signatures.members:
+        raise ValueError(f"the signature fields lack a member {label}")
+
+    def member(field: _Dictionary) -> str:
+        return http_sf.ser({label: field.members[label]})  # type: ignore[dict-item]
+
+    return lines.with_replaced("Signature-Input", member(inputs)).with_replaced(
+        "Signature", member(signatures)
+    )
+
+
+def signature_values(lines: HeaderLines) -> tuple[str, str]:
+    """The ``Signature-Input`` and ``Signature`` values as serialized, unparsed.
+
+    Raises ``ValueError`` when either is absent.
+    """
+    signature_input, signature = lines.get("signature-input"), lines.get("signature")
+    if signature_input is None or signature is None:
+        raise ValueError("the message carries no Signature-Input and Signature pair")
+    return signature_input, signature
+
+
+# ── Content-Digest ────────────────────────────────────────────────────────
+
+
+class ContentDigestError(ValueError):
+    """A ``Content-Digest`` that is absent, malformed, or doesn't match the body.
+
+    Each caller maps it to its own refusal or :class:`SigningError`.
+    """
+
+
+def content_digest(body: bytes) -> str:
+    """Returns the ``Content-Digest`` value for ``body`` (RFC 9530, ``sha-256``)."""
+    return ContentDigest.create(body)
+
+
+def check_content_digest(lines: HeaderLines, body: bytes) -> None:
+    """Checks the message's ``Content-Digest`` against ``body``, as the profile requires.
+
+    Every member must match the body (RFC 9530), a repeated algorithm fails,
+    and a ``sha-256`` member must be among them. Raises
+    :class:`ContentDigestError`.
+    """
+    value = lines.get("content-digest")
+    if value is None:
+        raise ContentDigestError("Content-Digest is absent")
+    try:
+        ContentDigest.verify(value, body)
+    except HTTPMessageSignaturesException as e:
+        raise ContentDigestError(f"Content-Digest does not match the body: {e}") from e
+    # ContentDigest.verify parsed the same value, so this parse succeeds.
+    member = _parse_dictionary(value).members.get("sha-256")
+    digest, _ = _split(member)
+    if not isinstance(digest, bytes):
+        raise ContentDigestError("Content-Digest has no sha-256 member")
+
+
+__all__ = [
+    "ComponentId",
+    "ComponentParam",
+    "ContentDigestError",
+    "SignatureAgentMember",
+    "SignatureFields",
+    "SignatureMember",
+    "check_content_digest",
+    "component_id",
+    "content_digest",
+    "is_signed",
+    "only_member",
+    "parse_signature_fields",
+    "signature_values",
+]
diff --git a/src/iab_agentic_primitives/web_bot_auth/asgi.py b/src/iab_agentic_primitives/web_bot_auth/asgi.py
new file mode 100644
index 0000000..a8fe351
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/asgi.py
@@ -0,0 +1,641 @@
+"""Thin ASGI helpers: sign responses, serve the signed key directory, and,
+opt-in, require a signature.
+
+These are plain ASGI and import no framework, so they work with Starlette,
+FastAPI, or any ASGI server.
+
+- :func:`request_url` rebuilds a request's URL on a :class:`ServerIdentity`,
+  under the URL rule every signer signs under, so a server that only verifies
+  needs nothing more.
+- :class:`ServerEdge` is the server's one identity at its edges, with the
+  signer, the directory, and the confirmer that depend on it, checked against
+  each other once. Both middlewares take it, and :meth:`ServerEdge.request_url`
+  rebuilds a request's URL on it, so the request a server verifies and the
+  request it binds a response to are rebuilt from one base URL.
+- :class:`ResponseSigningMiddleware` signs each buffered response and binds it
+  to the request it answers, and serves the directory of the key it signs
+  with. It passes streaming responses (``text/event-stream``) through unsigned.
+- :class:`DirectoryMiddleware` answers ``GET`` on the well-known directory path
+  with the signed key directory of a :class:`~.directory.DirectoryPublisher`,
+  for a party that signs no responses. A framework route answers the same with
+  :meth:`DirectoryPublisher.answer`.
+- :class:`RequireSignatureMiddleware` is opt-in. It verifies inbound
+  signatures, refuses failures, and hands the app the :class:`VerifiedRequest`,
+  which :func:`verified_request` reads from the scope. An application that
+  resolves identity at its own boundary calls :meth:`RequestVerifier.verify`
+  there instead.
+
+Every answer the helpers write, refusals included, comes from
+:mod:`.presentation`; this module only serializes it to ASGI messages.
+"""
+
+from __future__ import annotations
+
+import logging
+from collections.abc import Awaitable, Callable, Iterable, Mapping, MutableMapping
+from dataclasses import dataclass
+from typing import Literal
+from urllib.parse import quote, quote_from_bytes
+
+from .directory import DirectoryPublisher
+from .errors import ConfigurationError, SigningError, WebBotAuthError
+from .message import Answer, HeaderLines, HTTPRequest, HTTPResponse, target_uri
+from .presentation import (
+    body_too_large_response,
+    method_not_allowed_response,
+    refusal_response,
+    unsignable_response,
+)
+from .roles import RequestConfirmer, ResponseSigning
+from .rules import STREAMING, Streaming
+from .values import DIRECTORY_PATH, Clock, ServerIdentity, is_decimal, system_clock, whole_number
+from .verifier import VerifiedRequest, is_signed
+
+Scope = MutableMapping[str, object]
+Message = MutableMapping[str, object]
+Receive = Callable[[], Awaitable[Message]]
+Send = Callable[[Message], Awaitable[None]]
+ASGIApp = Callable[[Scope, Receive, Send], Awaitable[None]]
+
+#: The ``scope["state"]`` key that holds the :class:`VerifiedRequest`.
+STATE_KEY = "web_bot_auth"
+logger = logging.getLogger(__name__)
+
+
+# ── reading ASGI mappings, typed once ─────────────────────────────────────
+
+
+def _of_type[T](mapping: Scope | Message, key: str, kind: type[T], default: T) -> T:
+    value = mapping.get(key, default)
+    if not isinstance(value, kind):
+        raise TypeError(f"ASGI {key!r} is a {kind.__name__}, not {value!r}")
+    return value
+
+
+def _method(scope: Scope) -> str:
+    return _of_type(scope, "method", str, "GET")
+
+
+def _state(scope: Scope) -> dict[str, object]:
+    state = scope.get("state")
+    return dict(state) if isinstance(state, Mapping) else {}
+
+
+def _raw_lines(scope_or_message: Scope | Message) -> list[tuple[bytes, bytes]]:
+    lines = scope_or_message.get("headers", [])
+    if not isinstance(lines, Iterable):
+        raise TypeError(f"ASGI headers are pairs of bytes, not {lines!r}")
+    return [(bytes(k), bytes(v)) for k, v in lines]
+
+
+def _headers(scope_or_message: Scope | Message) -> list[tuple[str, str]]:
+    return [(k.decode("latin-1"), v.decode("latin-1")) for k, v in _raw_lines(scope_or_message)]
+
+
+def verified_request(scope: Scope) -> VerifiedRequest | None:
+    """The :class:`VerifiedRequest` that :class:`RequireSignatureMiddleware` put on ``scope``.
+
+    ``None`` for a request the middleware let through unsigned, or didn't see.
+    """
+    verified = _state(scope).get(STATE_KEY)
+    return verified if isinstance(verified, VerifiedRequest) else None
+
+
+def _checked_identity(identity: object) -> ServerIdentity:
+    if not isinstance(identity, ServerIdentity):
+        raise ConfigurationError(
+            "identity is a ServerIdentity, such as "
+            f"ServerIdentity.from_config('https://seller.example.com'), not {identity!r}"
+        )
+    return identity
+
+
+def _checked_edge(edge: object) -> ServerEdge:
+    if not isinstance(edge, ServerEdge):
+        raise ConfigurationError(f"edge is a ServerEdge, not {edge!r}")
+    return edge
+
+
+#: The printable ASCII a rebuilt path keeps as received: all but ``?`` and ``#``,
+#: which would end it. A rebuilt query keeps ``?`` too.
+_PATH_KEPT = "".join(chr(c) for c in range(0x21, 0x7F) if chr(c) not in "?#")
+_QUERY_KEPT = _PATH_KEPT + "?"
+
+
+def request_url(identity: ServerIdentity, scope: Scope) -> str:
+    """Rebuilds the absolute URL the client requested, on the server's own base URL.
+
+    ``identity.base_url``, such as ``https://seller.example.com``, is the
+    server's public base URL, whatever ``Host`` the client sends: the ``Host``
+    header is the client's claim, and a signature covers ``@authority`` and
+    ``@target-uri`` so that a request signed for one server doesn't verify at
+    another. The path and query are the bytes the client sent (``raw_path``
+    and ``query_string``), any byte outside printable ASCII percent-encoded,
+    and the URL is :func:`~.message.target_uri` of the result, the URL rule
+    every signer signs under. It needs only the identity, so a server that
+    verifies requests and signs nothing passes this URL to its
+    :class:`RequestVerifier`; :meth:`ServerEdge.request_url` is the same
+    rebuild.
+    """
+    checked = _checked_identity(identity)
+    raw_path = _of_type(scope, "raw_path", bytes, b"")
+    path = (
+        quote_from_bytes(raw_path, safe=_PATH_KEPT)
+        if raw_path
+        else quote(_of_type(scope, "path", str, "/"), safe=_PATH_KEPT)
+    )
+    query = quote_from_bytes(_of_type(scope, "query_string", bytes, b""), safe=_QUERY_KEPT)
+    return target_uri(f"{checked.base_url}{path if path.startswith('/') else '/' + path}?{query}")
+
+
+async def _read_body(
+    receive: Receive, limit: int, headers: HeaderLines
+) -> tuple[bytes, list[Message]]:
+    """The request body and the messages it came in; ``_BodyTooLarge`` past ``limit`` bytes."""
+    declared = _declared_length(headers)
+    if declared is not None and declared > limit:
+        raise _BodyTooLarge
+    chunks: list[bytes] = []
+    messages: list[Message] = []
+    size = 0
+    while True:
+        message = await receive()
+        messages.append(message)
+        if message["type"] != "http.request":  # http.disconnect
+            break
+        chunk = _of_type(message, "body", bytes, b"")
+        size += len(chunk)
+        if size > limit:
+            raise _BodyTooLarge
+        chunks.append(chunk)
+        if not message.get("more_body", False):
+            break
+    return b"".join(chunks), messages
+
+
+def _replay(messages: list[Message], receive: Receive) -> Receive:
+    pending = list(messages)
+
+    async def replay() -> Message:
+        if pending:
+            return pending.pop(0)
+        return await receive()
+
+    return replay
+
+
+#: The default body limit of both middlewares, in bytes.
+MAX_BODY_BYTES = 1024 * 1024
+
+
+def _declared_length(lines: HeaderLines) -> int | None:
+    value = lines.get("content-length")
+    return int(value) if value is not None and is_decimal(value) else None
+
+
+def _raw(lines: Iterable[tuple[str, str]]) -> list[tuple[bytes, bytes]]:
+    """Field lines as ASGI encodes them: lowercase latin-1 names, latin-1 values."""
+    return [(k.lower().encode("latin-1"), v.encode("latin-1")) for k, v in lines]
+
+
+async def _send(send: Send, answer: Answer, *, head: bool = False) -> None:
+    """Sends ``answer``, the one serializer of every answer the helpers write.
+
+    ``Content-Length`` is always the length of ``answer.body``. For ``HEAD``
+    the body isn't sent, and every header, ``Content-Length`` included, is the
+    one ``GET`` gets (RFC 9110 section 9.3.2).
+    """
+    raw = _raw(answer.headers)
+    raw.append((b"content-length", str(len(answer.body)).encode()))
+    await send({"type": "http.response.start", "status": answer.status, "headers": raw})
+    await send({"type": "http.response.body", "body": b"" if head else answer.body})
+
+
+@dataclass(frozen=True, slots=True, init=False)
+class DirectoryMiddleware:
+    """Serves the signed key directory at the well-known path and passes other requests on.
+
+    ``publisher`` is the :class:`~.directory.DirectoryPublisher` of the
+    server's own identity: it reads the key source on every request and signs
+    the response afresh, for its origin's authority, whatever ``Host`` the
+    client sends, so the ``"@authority";req`` binding keeps another domain from
+    serving the key set again. ``GET`` and ``HEAD`` are answered; anything else
+    gets ``405``. It is immutable.
+    """
+
+    app: ASGIApp
+    publisher: DirectoryPublisher
+    clock: Clock
+
+    def __init__(
+        self, app: ASGIApp, publisher: DirectoryPublisher, *, clock: Clock = system_clock
+    ) -> None:
+        if not isinstance(publisher, DirectoryPublisher):
+            raise ConfigurationError(f"publisher is a DirectoryPublisher, not {publisher!r}")
+        object.__setattr__(self, "app", app)
+        object.__setattr__(self, "publisher", publisher)
+        object.__setattr__(self, "clock", clock)
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
+        if scope["type"] != "http" or scope.get("path") != DIRECTORY_PATH:
+            await self.app(scope, receive, send)
+            return
+        method = _method(scope)
+        if method not in ("GET", "HEAD"):
+            await _send(send, method_not_allowed_response())
+            return
+        await _send(send, await self.publisher.answer(self.clock()), head=method == "HEAD")
+
+
+#: The ASGI extensions that let an app send a response the middleware can't buffer
+#: and sign: a file by path, a file by descriptor, and trailers. The app never sees them.
+UNSIGNABLE_EXTENSIONS = (
+    "http.response.pathsend",
+    "http.response.zerocopy",
+    "http.response.trailers",
+)
+
+
+def _signable_scope(scope: Scope) -> Scope:
+    """``scope`` without the extensions that bypass a buffered response."""
+    extensions = scope.get("extensions")
+    if not isinstance(extensions, Mapping) or not extensions:
+        return scope
+    kept = {k: v for k, v in extensions.items() if k not in UNSIGNABLE_EXTENSIONS}
+    return {**scope, "extensions": kept}
+
+
+#: Where a buffered response is: before its start, holding it back, passing it
+#: through unsigned, or answered.
+_State = Literal["waiting", "holding", "passthrough", "done"]
+
+
+class _BufferedResponse:
+    """The ``send`` a signed app gets: it holds back the start, buffers the body up to
+    ``limit`` bytes, and sends the signed response when the body ends.
+
+    A response that is already signed or streams (``streaming``) passes through as
+    sent. A second start, any other message after a held-back start, and a
+    body over ``limit`` can't be signed, and are answered with ``500``.
+    """
+
+    def __init__(self, signer: ResponseSigning, request: HTTPRequest, options: _Options) -> None:
+        self._signer = signer
+        self._request = request
+        self._options = options
+        self._state: _State = "waiting"
+        self._start: Message = {}
+        self._chunks: list[bytes] = []
+        self._size = 0
+
+    async def __call__(self, message: Message) -> None:
+        kind = message["type"]
+        match self._state, kind:
+            case ("passthrough", _) | ("waiting", "http.response.body"):
+                await self._options.send(message)
+            case ("waiting", "http.response.start"):
+                await self._started(message)
+            case ("holding", "http.response.body"):
+                await self._body(message)
+            case ("holding", _):
+                await self._unsignable(SigningError(f"the app sent {kind!r}, not a body"))
+            case _:
+                pass  # the answer is sent; nothing more belongs to it
+
+    async def _started(self, message: Message) -> None:
+        lines = HeaderLines(_headers(message))
+        if lines.carries_signature_field() or self._options.streaming.streams(lines.media_type()):
+            self._state = "passthrough"
+            await self._options.send(message)
+            return
+        self._state, self._start = "holding", message
+        declared = _declared_length(lines)
+        if declared is not None and declared > self._options.limit:
+            await self._too_large()
+
+    async def _body(self, message: Message) -> None:
+        chunk = _of_type(message, "body", bytes, b"")
+        self._size += len(chunk)
+        if self._size > self._options.limit:
+            await self._too_large()
+            return
+        self._chunks.append(chunk)
+        if not message.get("more_body", False):
+            await self._finish()
+
+    async def _finish(self) -> None:
+        body = b"".join(self._chunks)
+        status = _of_type(self._start, "status", int, 0)
+        response = HTTPResponse(status, _headers(self._start), body, self._request)
+        try:
+            signed = self._signer.sign(response)
+        except SigningError as e:
+            await self._unsignable(e)
+            return
+        self._state = "done"
+        added = _raw(signed.headers.items()[len(response.headers) :])
+        await self._options.send({**self._start, "headers": [*_raw_lines(self._start), *added]})
+        await self._options.send({"type": "http.response.body", "body": body})
+
+    async def _too_large(self) -> None:
+        limit = self._options.limit
+        await self._unsignable(SigningError(f"the response body exceeds {limit} bytes"))
+
+    async def _unsignable(self, error: SigningError) -> None:
+        # A response the profile can't sign, such as a body without Content-Type, is an
+        # application bug. Refuse loudly instead of sending it unsigned.
+        self._state = "done"
+        logger.error(
+            "cannot sign the response to %s %s: %s", self._request.method, self._request.url, error
+        )
+        await _send(self._options.send, unsignable_response(error))
+
+
+@dataclass(frozen=True, slots=True)
+class _Options:
+    send: Send
+    streaming: Streaming
+    limit: int
+
+
+@dataclass(frozen=True, slots=True)
+class SigningPolicy:
+    """What :class:`ResponseSigningMiddleware` signs, checked once.
+
+    Responses that ``streaming`` names (:data:`~.rules.STREAMING`,
+    ``text/event-stream``, by default) stream, and pass through unsigned;
+    a client configured with the same :class:`~.rules.Streaming` takes them
+    unsigned. A response body is buffered up to ``max_body_bytes`` (1 MiB by
+    default). A bad value raises :class:`ConfigurationError`.
+    """
+
+    streaming: Streaming = STREAMING
+    max_body_bytes: int = MAX_BODY_BYTES
+
+    def __post_init__(self) -> None:
+        if not isinstance(self.streaming, Streaming):
+            raise ConfigurationError(f"streaming is a Streaming, not {self.streaming!r}")
+        whole_number("max_body_bytes", self.max_body_bytes, minimum=0)
+
+
+#: The default signing policy: stream ``text/event-stream`` unsigned, buffer 1 MiB at most.
+DEFAULT_SIGNING = SigningPolicy()
+
+
+@dataclass(frozen=True, slots=True, init=False)
+class ServerEdge:
+    """A server's one identity at its edges, and what depends on it, checked together once.
+
+    ``identity`` is the server's :class:`ServerIdentity`, from configuration:
+    the only place the edges read its base URL. ``signer`` signs its responses
+    as ``identity.origin``, and ``publisher`` is the
+    :class:`~.directory.DirectoryPublisher` of that origin, which, for a list
+    of keys, lists ``signer.keyid``. ``confirmer``, when the server verifies
+    requests at its edge, is a :class:`~.roles.RequestConfirmer`, such as a
+    :class:`RequestVerifier`, whose own ``identity`` is ``identity``, base URL
+    included. Any mismatch raises :class:`ConfigurationError` when the edge is
+    made, so a server never starts up accepting requests whose responses its
+    peers would refuse. It is immutable.
+
+    :class:`ResponseSigningMiddleware` and :class:`RequireSignatureMiddleware`
+    take one edge, and :meth:`request_url` rebuilds a request's URL on it, so
+    every request a server verifies or answers is rebuilt on one base URL.
+    """
+
+    identity: ServerIdentity
+    signer: ResponseSigning
+    publisher: DirectoryPublisher
+    confirmer: RequestConfirmer | None
+
+    def __init__(
+        self,
+        identity: ServerIdentity,
+        *,
+        signer: ResponseSigning,
+        publisher: DirectoryPublisher,
+        confirmer: RequestConfirmer | None = None,
+    ) -> None:
+        checked = _checked_identity(identity)
+        if not isinstance(publisher, DirectoryPublisher):
+            raise ConfigurationError(f"publisher is a DirectoryPublisher, not {publisher!r}")
+        if signer.origin != checked.origin:
+            raise ConfigurationError(
+                f"the signer signs as {signer.origin}, but the server's identity is "
+                f"{checked.origin}"
+            )
+        publisher.check_signer(signer.origin, signer.keyid)
+        if confirmer is not None and confirmer.identity != checked:
+            raise ConfigurationError(
+                f"the confirmer verifies requests to {confirmer.identity.base_url}, but the "
+                f"server's base URL is {checked.base_url}"
+            )
+        object.__setattr__(self, "identity", checked)
+        object.__setattr__(self, "signer", signer)
+        object.__setattr__(self, "publisher", publisher)
+        object.__setattr__(self, "confirmer", confirmer)
+
+    def request_url(self, scope: Scope) -> str:
+        """Rebuilds the absolute URL the client requested: :func:`request_url` on ``identity``.
+
+        An application that verifies at its own boundary passes this URL to
+        its verifier, so a verifier configured for another base URL refuses
+        the request instead of the server answering with responses its peers
+        refuse.
+        """
+        return request_url(self.identity, scope)
+
+
+@dataclass(frozen=True, slots=True, init=False)
+class ResponseSigningMiddleware:
+    """Signs every buffered response with ``edge.signer``, bound to the request it answers,
+    and serves the directory its peers verify those signatures with.
+
+    ``edge`` is the server's :class:`ServerEdge`: the request each response
+    answers is rebuilt with :meth:`ServerEdge.request_url`, and
+    ``edge.publisher``'s directory is served at the well-known path, as
+    :class:`DirectoryMiddleware` serves it.
+
+    :class:`SigningPolicy` holds the options. The middleware passes through
+    unsigned the responses its ``streaming`` rule names, which stream, and
+    responses that already carry a signature. A response it can't sign under
+    the profile, such as a body without ``Content-Type``, or a body over
+    ``max_body_bytes``, becomes a ``500`` with error ``response-unsignable``
+    and is logged, so a route never sends an unsigned answer silently. The
+    app's scope doesn't advertise ``http.response.pathsend``,
+    ``http.response.zerocopy``, or ``http.response.trailers``, so a file
+    response is sent as a body and signed. A request whose ``web-bot-auth``
+    signature is incomplete (no ``Signature`` member) gets an unbound
+    response. It is immutable.
+    """
+
+    app: ASGIApp
+    edge: ServerEdge
+    directory: DirectoryMiddleware
+    policy: SigningPolicy
+
+    def __init__(
+        self, app: ASGIApp, edge: ServerEdge, *, policy: SigningPolicy = DEFAULT_SIGNING
+    ) -> None:
+        checked = _checked_edge(edge)
+        object.__setattr__(self, "app", app)
+        object.__setattr__(self, "edge", checked)
+        object.__setattr__(self, "directory", DirectoryMiddleware(app, checked.publisher))
+        object.__setattr__(self, "policy", policy)
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
+        if scope["type"] != "http":
+            await self.app(scope, receive, send)
+            return
+        if scope.get("path") == DIRECTORY_PATH:
+            await self.directory(scope, receive, send)
+            return
+        request = HTTPRequest(_method(scope), self.edge.request_url(scope), _headers(scope))
+        policy = self.policy
+        options = _Options(send, policy.streaming, policy.max_body_bytes)
+        await self.app(
+            _signable_scope(scope), receive, _BufferedResponse(self.edge.signer, request, options)
+        )
+
+
+#: What :class:`RequireSignatureMiddleware` does with an unsigned request.
+OnUnsigned = Literal["refuse", "pass"]
+
+
+@dataclass(frozen=True, slots=True)
+class RequirePolicy:
+    """What :class:`RequireSignatureMiddleware` requires of a request, checked once.
+
+    ``prefixes`` are the paths it guards. An unsigned request is refused
+    (``on_unsigned="refuse"``, the default) or passed on with no identity
+    (``"pass"``). A signed request's body is read up to ``max_body_bytes``
+    (1 MiB by default). A bad value raises :class:`ConfigurationError`.
+    """
+
+    prefixes: tuple[str, ...] = ("/",)
+    on_unsigned: OnUnsigned = "refuse"
+    max_body_bytes: int = MAX_BODY_BYTES
+
+    def __post_init__(self) -> None:
+        if isinstance(self.prefixes, str) or not all(isinstance(p, str) for p in self.prefixes):
+            raise ConfigurationError(f"prefixes is a tuple of paths, not {self.prefixes!r}")
+        if self.on_unsigned not in ("refuse", "pass"):
+            raise ConfigurationError(f"on_unsigned is 'refuse' or 'pass', not {self.on_unsigned!r}")
+        whole_number("max_body_bytes", self.max_body_bytes, minimum=0)
+
+
+#: The default policy: guard every path, refuse an unsigned request, and read 1 MiB at most.
+DEFAULT_REQUIRE = RequirePolicy()
+
+
+class _BodyTooLarge(Exception):
+    pass
+
+
+def _has_body(headers: HeaderLines) -> bool:
+    """Whether the request declares a body, read from its header alone."""
+    return bool(_declared_length(headers)) or "transfer-encoding" in headers
+
+
+@dataclass(frozen=True, slots=True, init=False)
+class RequireSignatureMiddleware:
+    """Opt-in: verifies inbound signatures on the paths ``policy.prefixes`` names.
+
+    ``edge`` is the server's :class:`ServerEdge`, and its ``confirmer``, such
+    as a :class:`RequestVerifier`, verifies each request; an edge without one
+    raises :class:`ConfigurationError`. The middleware rebuilds each request
+    URL with :meth:`ServerEdge.request_url`, as
+    :class:`ResponseSigningMiddleware` does with the same edge.
+    :class:`RequirePolicy` holds the options. An
+    unsigned request is refused (``on_unsigned="refuse"``, the default) or
+    passed on with no identity (``"pass"``), decided from its header before
+    any of its body is read: a request is signed when it carries
+    ``Signature-Input`` (:func:`~.verifier.is_signed`). A signed request's body is read up to
+    ``max_body_bytes`` (1 MiB by default); a larger one is answered ``413``. A
+    request whose signature fails is always refused, with
+    :func:`~.presentation.refusal_response`. A verified request reaches the app
+    with its :class:`VerifiedRequest`, which :func:`verified_request` reads. It
+    is immutable.
+    """
+
+    app: ASGIApp
+    edge: ServerEdge
+    confirmer: RequestConfirmer
+    policy: RequirePolicy
+
+    def __init__(
+        self, app: ASGIApp, edge: ServerEdge, *, policy: RequirePolicy = DEFAULT_REQUIRE
+    ) -> None:
+        checked = _checked_edge(edge)
+        if checked.confirmer is None:
+            raise ConfigurationError(
+                "RequireSignatureMiddleware verifies with the edge's confirmer: "
+                "pass ServerEdge(..., confirmer=verifier)"
+            )
+        object.__setattr__(self, "app", app)
+        object.__setattr__(self, "edge", checked)
+        object.__setattr__(self, "confirmer", checked.confirmer)
+        object.__setattr__(self, "policy", policy)
+
+    def _guarded(self, scope: Scope) -> bool:
+        path = _of_type(scope, "path", str, "")
+        return (
+            scope["type"] == "http"
+            and path != DIRECTORY_PATH
+            and path.startswith(self.policy.prefixes)
+        )
+
+    async def __call__(self, scope: Scope, receive: Receive, send: Send) -> None:
+        if not self._guarded(scope):
+            await self.app(scope, receive, send)
+            return
+        headers = HeaderLines(_headers(scope))
+        url = self.edge.request_url(scope)
+        if not is_signed(headers):
+            if self.policy.on_unsigned == "pass":
+                await self.app(scope, receive, send)
+                return
+            # The core refuses it from the header alone; the body is never read.
+            await self._verify(send, HTTPRequest(_method(scope), url, headers), _has_body(headers))
+            return
+        try:
+            body, messages = await _read_body(receive, self.policy.max_body_bytes, headers)
+        except _BodyTooLarge:
+            await _send(send, body_too_large_response())
+            return
+        verified = await self._verify(
+            send, HTTPRequest(_method(scope), url, headers, body), bool(body)
+        )
+        if verified is not None:
+            state = {**_state(scope), STATE_KEY: verified}
+            await self.app({**scope, "state": state}, _replay(messages, receive), send)
+
+    async def _verify(
+        self, send: Send, request: HTTPRequest, has_body: bool
+    ) -> VerifiedRequest | None:
+        """The verified request, or ``None`` once its refusal is sent."""
+        try:
+            return await self.confirmer.verify(request)
+        except WebBotAuthError as e:
+            await _send(send, refusal_response(e, has_body=has_body))
+            return None
+
+
+__all__ = [
+    "DEFAULT_REQUIRE",
+    "DEFAULT_SIGNING",
+    "MAX_BODY_BYTES",
+    "ASGIApp",
+    "DirectoryMiddleware",
+    "Message",
+    "OnUnsigned",
+    "Receive",
+    "RequirePolicy",
+    "RequireSignatureMiddleware",
+    "ResponseSigningMiddleware",
+    "Scope",
+    "Send",
+    "ServerEdge",
+    "SigningPolicy",
+    "request_url",
+    "verified_request",
+]
diff --git a/src/iab_agentic_primitives/web_bot_auth/conformance/PROTOCOL.md b/src/iab_agentic_primitives/web_bot_auth/conformance/PROTOCOL.md
new file mode 100644
index 0000000..39ed1ea
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/conformance/PROTOCOL.md
@@ -0,0 +1,177 @@
+# Web Bot Auth interop adapter protocol
+
+An adapter connects one Web Bot Auth (WBA) implementation to a harness. Two
+harnesses speak this protocol:
+
+- `python -m iab_agentic_primitives.web_bot_auth.conformance run --adapter "<command>"`
+  grades the implementation against this library. It splits the command with
+  shell quoting rules and runs it without a shell.
+- `tests/web_bot_auth/interop/run.mjs` in the repository grades it against one
+  judge: Cloudflare's `web-bot-auth` and `http-message-sig` libraries at the
+  versions pinned in its `package.json`, with the profile's rules from
+  `policy.mjs`. It passes the command to a shell.
+
+This file ships in the package, at
+`iab_agentic_primitives/web_bot_auth/conformance/PROTOCOL.md`, beside the
+vectors it grades.
+
+An adapter is one executable. For each operation, the harness starts the
+executable, writes one JSON object to its standard input, and reads one JSON
+object from its standard output. With `--persistent`, the Node harness starts
+the executable once and exchanges one JSON object per line in each direction.
+
+```bash
+npm ci --prefix tests/web_bot_auth/interop
+node tests/web_bot_auth/interop/run.mjs --persistent \
+  --adapter "python -m iab_agentic_primitives.web_bot_auth.conformance adapter --lines" \
+  --json checks.json
+```
+
+## Shared shapes
+
+- **Request**: `{ "method", "url", "headers", "body" }`. `headers` is an array
+  of `[name, value]` pairs of strings, one per field line, in wire order, so a
+  repeated field keeps each line; names are case-insensitive. `body` is the
+  exact bytes on the wire: a string of UTF-8 text, or `{ "base64": "..." }`
+  (standard Base64 with padding) when the bytes aren't UTF-8. It is `""` for a
+  request with no body.
+- **Response**: `{ "status", "headers", "body" }`.
+- **Directory response**: `{ "url", "status", "headers", "body" }`, the signed
+  response a key directory server sends for
+  `<origin>/.well-known/http-message-signatures-directory`.
+- **Key**: a private JWK, `{ "kty": "OKP", "crv": "Ed25519", "x", "d" }`. Every key
+  is a published test key from `keys.json`, which a production verifier SHOULD
+  refuse (WBA section 6.8). An adapter configures its implementation to accept
+  them.
+- **Time**: `now` is Unix seconds. The adapter uses it as the clock for signing
+  and verification, never the system clock.
+- **Refusal**: `{ "ok": false, "status", "rule", "error" }`. `status` is the HTTP
+  status the implementation answers: `400`, `403`, `429`, or `503`. `rule` is a
+  rule of the shared vocabulary in `vectors/refusals.json`, which lists every
+  rule with its status (it is generated from the `Refusal` enum). `error` is
+  free text that the report shows.
+- **Adapter failure**: a harness records an adapter that crashes, times out,
+  or answers something that isn't a result as a refusal with no `status` and
+  the rule `adapter-crash` (with the exit code), `adapter-timeout`,
+  `adapter-invalid`, or `adapter-error`. No expected refusal accepts it.
+
+## Operations
+
+### `sign_request`
+
+Sign `request` as the identity `origin`, at `now`, under the profile.
+
+```json
+{ "op": "sign_request", "key": { "kty": "OKP", "crv": "Ed25519", "x": "...", "d": "..." },
+  "origin": "https://buyer.example.com", "request": { "method": "POST", "url": "...", "headers": [["Content-Type", "application/json"]], "body": "..." },
+  "now": 1794052800 }
+```
+
+The output is the signed request: the input request with `Signature-Agent`
+(the key directory URL, `<origin>/.well-known/http-message-signatures-directory`),
+`Signature-Input`, `Signature`, and, when the request has a body,
+`Content-Digest` added.
+
+### `sign_directory`
+
+Serve and sign the key directory of `origin`, which publishes `keys`, at `now`.
+
+```json
+{ "op": "sign_directory", "keys": [{ "kty": "OKP", "crv": "Ed25519", "x": "...", "d": "..." }],
+  "origin": "https://buyer.example.com", "now": 1794052800 }
+```
+
+The output is the directory response.
+
+### `sign_response`
+
+Sign `response` as the identity `origin`, at `now`, as the answer to `request`
+(which carries its own signature when the request was signed).
+
+```json
+{ "op": "sign_response", "key": { "...": "..." }, "origin": "https://seller.example.com",
+  "request": { "...": "..." }, "response": { "status": 200, "headers": [["Content-Type", "application/json"]], "body": "..." }, "now": 1794052800 }
+```
+
+The output is the signed response.
+
+### `verify_request`
+
+Verify `request` at `now`, as the verifier whose own authority is `authority`
+(its configured host and port, such as `seller.example.com`; § 2.8.4 step 5
+refuses a request signed for another, with the rule `authority`).
+`directories` maps each origin to the signed directory response its well-known
+path serves; an origin absent from the map serves no directory, and the
+adapter fetches nothing from the network. `prior` lists requests to verify
+first, with the same replay state, which is how the harness builds a replay
+without reaching into the implementation's replay store.
+
+```json
+{ "op": "verify_request", "request": { "...": "..." }, "authority": "seller.example.com",
+  "directories": { "https://buyer.example.com": { "url": "...", "status": 200, "headers": [["Content-Type", "application/json"]], "body": "..." } },
+  "now": 1794052810, "prior": [] }
+```
+
+The output is `{ "ok": true, "identity", "keyid" }`, where `identity` is the
+origin the implementation attributes the request to, whichever `Signature-Agent`
+form named it, or a refusal.
+
+### `verify_directory`
+
+Verify the signed directory response of `origin` at `now`.
+
+```json
+{ "op": "verify_directory", "origin": "https://buyer.example.com", "response": { "...": "..." }, "now": 1794052810 }
+```
+
+The output is `{ "ok": true, "keyids" }` or a refusal. A directory refusal is a
+`403` with a `directory-*` rule, the refusal the request that needed the key
+gets.
+
+### `verify_response`
+
+Verify `response` to `request` at `now`, with `directories` as for
+`verify_request`. When `expected_origin` is given, the response must be signed
+by that origin (rule `origin-mismatch`).
+
+```json
+{ "op": "verify_response", "request": { "...": "..." }, "response": { "...": "..." },
+  "directories": { "https://seller.example.com": { "...": "..." } }, "now": 1794052810,
+  "expected_origin": "https://seller.example.com" }
+```
+
+The output is `{ "ok": true, "identity", "keyid", "bound" }` or a refusal.
+
+## What the harness runs
+
+`run.mjs` runs three suites and records, for each message, the adapter's
+verdict, the judge's verdict, and the bare library's verdict:
+
+- **`vectors`**: the committed vectors, each sent as its own `operation`,
+  unchanged, at its `reference_now`; the operation names the verification
+  that grades it and carries the signed directories it needs.
+- **`live`**: the adapter signs a `POST`, a `GET`, a response, and its own
+  directory, and the judge verifies them; then the judge signs and the adapter
+  verifies, once with the key directory URL and once with the bare origin in
+  `Signature-Agent`. Tampered copies (URL, body, status, or another request) must fail in
+  both. The judge signs requests with the library's own `sign()` and
+  `generateNonce`, which produces padded standard base64.
+- **`scenarios`**: the judge signs every scenario in `scenarios.json` at the
+  run's clock, and the adapter verifies it.
+
+A check passes when the adapter and the judge both give the expected outcome
+(a pass with the expected identity, or a refusal with the expected status and
+rule) and the bare library agrees with the tier: tier `wba` means the bare library
+already gives the expected outcome, and tier `profile` means it gives the
+opposite one, so only the profile's rules decide it. `run.mjs --self` uses the
+judge as the adapter, which checks every tier against the bare library.
+
+web-bot-auth 0.2.0 has no response verifier, so the judge verifies response
+signatures with `http-message-sig`, which resolves the `req` and `key`
+component parameters.
+
+## Out of scope
+
+The harness serves directories from data. It doesn't grade live fetches, the
+fetch rules (HTTPS, resolved-address checks, redirects, size and time limits),
+or directory caching; the Python tests in `tests/web_bot_auth/` grade those.
diff --git a/src/iab_agentic_primitives/web_bot_auth/conformance/__init__.py b/src/iab_agentic_primitives/web_bot_auth/conformance/__init__.py
new file mode 100644
index 0000000..3a8e8cd
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/conformance/__init__.py
@@ -0,0 +1,432 @@
+"""Conformance vectors for the Web Bot Auth profile, and a runner.
+
+The vectors are package data in ``web_bot_auth/vectors/``: ``keys.json``,
+``scenarios.json``, ``refusals.json``, ``positive/``, and ``negative/``. Their
+README states the format, and :mod:`.models` types it. ``PROTOCOL.md`` in this
+package states the adapter protocol.
+
+:func:`run_conformance` grades an implementation through an adapter (see
+:mod:`.adapter`) on three suites:
+
+- ``vectors``: the committed vectors, at each vector's ``reference_now``.
+- ``live``: the adapter signs and this library verifies, then this library
+  signs and the adapter verifies, at the current time, for the base requests
+  and for a ``GET`` to each URL in ``scenarios.json``'s ``target_uris``.
+- ``scenarios``: this library signs every scenario in ``scenarios.json``, and
+  the adapter verifies it.
+
+A check passes when the result matches the expected outcome: the identity
+for a pass, and both the status and the rule for a refusal.
+
+Run it from another repository::
+
+    python -m iab_agentic_primitives.web_bot_auth.conformance run --adapter "<command>"
+
+With no ``--adapter``, it grades this library.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Iterator, Mapping
+from dataclasses import asdict, dataclass, field, replace
+from importlib.resources import files
+from importlib.resources.abc import Traversable
+from typing import Literal
+
+from ..errors import Refusal
+from ..keys import Ed25519Key
+from ..signer import RequestSigner, SignerConfig
+from ..values import UnixSeconds, system_clock
+from .adapter import Adapter, CommandAdapter, LibraryAdapter
+from .models import (
+    DirectoryDoc,
+    KeysDocument,
+    KeysVerified,
+    Outcome,
+    Passes,
+    Refused,
+    RequestDoc,
+    RequestScenario,
+    ResponseDoc,
+    ResponseScenario,
+    Result,
+    ScenariosDocument,
+    SignDirectory,
+    SignRequest,
+    SignResponse,
+    Suite,
+    Tier,
+    Vector,
+    VectorOperation,
+    Verified,
+    VerifyDirectory,
+    VerifyRequest,
+    VerifyResponse,
+    passing,
+    read,
+    refusing,
+)
+from .signing import (
+    baseline_request,
+    sign_directory,
+    sign_directory_scenario,
+    sign_request_scenario,
+    sign_response_scenario,
+)
+
+#: The committed vectors, as package data.
+#: Found from this package's own name, so a vendored copy finds its own.
+VECTORS: Traversable = files(__name__.rpartition(".")[0]) / "vectors"
+#: The adapter protocol, as package data.
+PROTOCOL: Traversable = files(__name__) / "PROTOCOL.md"
+
+
+def vectors(directory: Traversable = VECTORS) -> Iterator[tuple[str, Vector]]:
+    """Yields ``(id, vector)`` for each positive, then each negative vector, sorted."""
+    for group in ("positive", "negative"):
+        entries = sorted(
+            (p for p in (directory / group).iterdir() if p.name.endswith(".json")),
+            key=lambda p: p.name,
+        )
+        for path in entries:
+            yield (
+                f"{group}/{path.name.removesuffix('.json')}",
+                read(Vector, path.read_text()),
+            )
+
+
+def keys_document(directory: Traversable = VECTORS) -> KeysDocument:
+    return read(KeysDocument, (directory / "keys.json").read_text())
+
+
+def scenarios_document(directory: Traversable = VECTORS) -> ScenariosDocument:
+    return read(ScenariosDocument, (directory / "scenarios.json").read_text())
+
+
+def published_keys(directory: Traversable = VECTORS) -> Mapping[str, Ed25519Key]:
+    """The published test keys, keyed by ``kid``."""
+    return {
+        entry.kid: Ed25519Key.from_jwk(entry.private_jwk())
+        for entry in keys_document(directory).keys
+    }
+
+
+def published_key_ids(directory: Traversable = VECTORS) -> frozenset[str]:
+    """The ``kid`` of every published test key; a production verifier refuses them (WBA 6.8)."""
+    return frozenset(published_keys(directory))
+
+
+def _directories(
+    refs: Mapping[str, tuple[str, ...]], keys: Mapping[str, Ed25519Key], now: UnixSeconds
+) -> dict[str, DirectoryDoc]:
+    """Each named root's directory, published with the keys ``refs`` names, at ``now``."""
+    return {root: sign_directory([keys[k] for k in kids], root, now) for root, kids in refs.items()}
+
+
+def vector_operation(vector: Vector) -> VectorOperation:
+    """The one operation that grades ``vector``, as the vector carries it."""
+    return vector.operation
+
+
+# ── grading ────────────────────────────────────────────────────────────────
+
+
+def meets(expected: Outcome, got: Result) -> bool:
+    """True when ``got`` is the expected outcome.
+
+    A pass needs a verified result, with the expected identity when one is
+    named. A refusal needs a :class:`~.models.Refused` with the expected
+    status and rule, so an adapter failure, whose status is ``None``, never
+    meets one.
+    """
+    if isinstance(expected, Passes):
+        named = None if expected.identity is None else str(expected.identity)
+        if isinstance(got, Verified):
+            return named in (None, got.identity)
+        return isinstance(got, KeysVerified) and named is None
+    return (
+        isinstance(got, Refused)
+        and got.status == expected.status
+        and got.rule == expected.rule.code
+    )
+
+
+def describe(got: Result) -> str:
+    if isinstance(got, Refused):
+        return f"{got.status or 'no status'} {got.rule}: {got.error}"
+    if isinstance(got, Verified):
+        return f"pass as {got.identity}"
+    return "pass" if isinstance(got, KeysVerified) else f"signed {type(got).__name__}"
+
+
+def want(expected: Outcome) -> str:
+    if isinstance(expected, Passes):
+        return "pass" + ("" if expected.identity is None else f" as {expected.identity}")
+    return f"{expected.status} {expected.rule.code}"
+
+
+@dataclass(frozen=True)
+class Check:
+    suite: Suite
+    id: str
+    ok: bool
+    expected: str
+    got: str
+    tier: Tier | None = None
+
+
+@dataclass
+class ConformanceReport:
+    checks: list[Check] = field(default_factory=list)
+
+    @property
+    def ok(self) -> bool:
+        return all(c.ok for c in self.checks)
+
+    @property
+    def failures(self) -> list[Check]:
+        return [c for c in self.checks if not c.ok]
+
+    def to_json(self) -> list[dict[str, object]]:
+        return [asdict(c) for c in self.checks]
+
+    def render(self) -> str:
+        lines = []
+        for c in self.checks:
+            tier = f"[{c.tier}] " if c.tier else ""
+            lines.append(f"{'pass' if c.ok else 'FAIL'}  {c.suite:<9} {tier}{c.id}")
+            if not c.ok:
+                lines.append(f"        expected {c.expected}\n        got      {c.got}")
+        passed = len(self.checks) - len(self.failures)
+        lines.append(f"\n{passed} of {len(self.checks)} checks pass.")
+        return "\n".join(lines)
+
+
+#: The refusals the live suite expects of tampered and replayed messages.
+_REPLAYED = refusing(Refusal.NONCE_REPLAYED)
+_TAMPERED = refusing(Refusal.SIGNATURE_INVALID)
+
+
+class _Run:
+    def __init__(self, adapter: Adapter, directory: Traversable) -> None:
+        self.adapter = adapter
+        self.reference = LibraryAdapter()
+        self.keys = published_keys(directory)
+        self.private = {e.kid: e.private_jwk() for e in keys_document(directory).keys}
+        self.doc = scenarios_document(directory)
+        self.directory = directory
+        self.report = ConformanceReport()
+
+    def record(
+        self, suite: Suite, id: str, expected: Outcome, got: Result, tier: Tier | None = None
+    ) -> None:
+        self.report.checks.append(
+            Check(suite, id, meets(expected, got), want(expected), describe(got), tier)
+        )
+
+    # ── vectors ──
+
+    def run_vectors(self) -> None:
+        for vid, vector in vectors(self.directory):
+            got = self.adapter(vector.operation)
+            self.record("vectors", vid, vector.expected, got, vector.tier)
+
+    # ── live ──
+
+    def _live_directory(self, now: UnixSeconds) -> DirectoryDoc:
+        signer = self.doc.signer
+        origin = signer.identity
+        theirs = self.adapter(
+            SignDirectory(keys=(self.private[signer.kid],), origin=origin, now=now)
+        )
+        got = (
+            self.reference(VerifyDirectory(origin=origin, response=theirs, now=now))
+            if isinstance(theirs, DirectoryDoc)
+            else theirs
+        )
+        self.record("live", "adapter signs the directory, reference verifies", passing(), got)
+        ours = sign_directory([self.keys[signer.kid]], str(origin), now)
+        got = self.adapter(VerifyDirectory(origin=origin, response=ours, now=now))
+        self.record("live", "reference signs the directory, adapter verifies", passing(), got)
+        return ours
+
+    def _live_requests(self, now: UnixSeconds, directory: DirectoryDoc) -> None:
+        signer = self.doc.signer
+        origin = signer.identity
+        ok = passing(origin)
+        dirs = {str(origin): directory}
+        authority = self.doc.verifier
+        for name, request in self.doc.requests.items():
+            label = name.upper()
+            signed = self.adapter(
+                SignRequest(key=self.private[signer.kid], origin=origin, request=request, now=now)
+            )
+            got = (
+                self.reference(
+                    VerifyRequest(request=signed, authority=authority, directories=dirs, now=now)
+                )
+                if isinstance(signed, RequestDoc)
+                else signed
+            )
+            self.record("live", f"adapter signs {label}, reference verifies", ok, got)
+            mine = RequestDoc.of(sign_request_scenario(self.doc, _baseline(name), self.keys, now))
+            op = VerifyRequest(request=mine, authority=authority, directories=dirs, now=now)
+            self.record("live", f"reference signs {label}, adapter verifies", ok, self.adapter(op))
+            twice = replace(op, prior=(mine,))
+            self.record(
+                "live",
+                f"reference signs {label}, adapter verifies it twice",
+                _REPLAYED,
+                self.adapter(twice),
+            )
+            joiner = "&" if "?" in mine.url else "?"
+            moved = replace(op, request=replace(mine, url=f"{mine.url}{joiner}t=1"))
+            self.record(
+                "live",
+                f"reference signs {label}, URL changed, adapter refuses",
+                _TAMPERED,
+                self.adapter(moved),
+            )
+
+    def _live_response(self, now: UnixSeconds) -> None:
+        responder = self.doc.responder
+        ok = passing(responder.identity)
+        seller = {
+            str(responder.identity): sign_directory(
+                [self.keys[responder.kid]], str(responder.identity), now
+            )
+        }
+        request = RequestDoc.of(baseline_request(self.doc, self.keys, now))
+        signed = self.adapter(
+            SignResponse(
+                key=self.private[responder.kid],
+                origin=responder.identity,
+                request=request,
+                response=self.doc.response,
+                now=now,
+            )
+        )
+        got = (
+            self.reference(
+                VerifyResponse(request=request, response=signed, directories=seller, now=now)
+            )
+            if isinstance(signed, ResponseDoc)
+            else signed
+        )
+        self.record(
+            "live", "adapter signs a response, reference verifies it and its binding", ok, got
+        )
+        mine_request, mine = sign_response_scenario(self.doc, _response_baseline(), self.keys, now)
+        op = VerifyResponse(request=mine_request, response=mine, directories=seller, now=now)
+        self.record(
+            "live",
+            "reference signs a response, adapter verifies it and its binding",
+            ok,
+            self.adapter(op),
+        )
+
+    def _live_target_uris(self, now: UnixSeconds, directory: DirectoryDoc) -> None:
+        """Each side signs a GET to each target-URI case's URL, as written; the other verifies."""
+        signer = self.doc.signer
+        origin = signer.identity
+        ok = passing(origin)
+        dirs = {str(origin): directory}
+        authority = self.doc.verifier
+        reference = RequestSigner(SignerConfig(self.keys[signer.kid], origin))
+        for case in self.doc.target_uris:
+            label = f"{case.id} {case.name}"
+            request = RequestDoc(method="GET", url=case.url)
+            signed = self.adapter(
+                SignRequest(key=self.private[signer.kid], origin=origin, request=request, now=now)
+            )
+            got = (
+                self.reference(
+                    VerifyRequest(request=signed, authority=authority, directories=dirs, now=now)
+                )
+                if isinstance(signed, RequestDoc)
+                else signed
+            )
+            self.record("live", f"adapter signs {label}, reference verifies", ok, got)
+            mine = reference.sign(request.message(), now=now)
+            written = replace(RequestDoc.of(mine), url=case.url)
+            op = VerifyRequest(request=written, authority=authority, directories=dirs, now=now)
+            self.record("live", f"reference signs {label}, adapter verifies", ok, self.adapter(op))
+
+    def run_live(self, now: UnixSeconds) -> None:
+        directory = self._live_directory(now)
+        self._live_requests(now, directory)
+        self._live_target_uris(now, directory)
+        self._live_response(now)
+
+    # ── scenarios ──
+
+    def run_scenarios(self, now: UnixSeconds) -> None:
+        signer, responder = self.doc.signer, self.doc.responder
+        default = {str(signer.identity): (signer.kid,)}
+        for s in self.doc.request_scenarios:
+            request = RequestDoc.of(sign_request_scenario(self.doc, s, self.keys, now))
+            op = VerifyRequest(
+                request=request,
+                authority=s.authority or self.doc.verifier,
+                directories=_directories(s.directories or default, self.keys, now),
+                now=now,
+            )
+            self.record("scenarios", f"{s.id} {s.name}", s.expected, self.adapter(op), s.tier)
+        for d in self.doc.directory_scenarios:
+            signed = sign_directory_scenario(self.doc, d, self.keys, now)
+            check = VerifyDirectory(origin=signer.identity, response=signed, now=now)
+            self.record("scenarios", f"{d.id} {d.name}", d.expected, self.adapter(check), d.tier)
+        seller = _directories({str(responder.identity): (responder.kid,)}, self.keys, now)
+        for r in self.doc.response_scenarios:
+            asked, answer = sign_response_scenario(self.doc, r, self.keys, now)
+            pair = VerifyResponse(request=asked, response=answer, directories=seller, now=now)
+            self.record("scenarios", f"{r.id} {r.name}", r.expected, self.adapter(pair), r.tier)
+
+
+def _baseline(base: Literal["post", "get"]) -> RequestScenario:
+    return RequestScenario(id="R00", name="Baseline", base=base, basis="", expected=passing())
+
+
+def _response_baseline() -> ResponseScenario:
+    return ResponseScenario(id="P00", name="Baseline", basis="", expected=passing())
+
+
+def run_conformance(
+    adapter: Adapter | str | None = None,
+    *,
+    now: UnixSeconds | None = None,
+    directory: Traversable = VECTORS,
+    suites: tuple[Suite, ...] = ("vectors", "live", "scenarios"),
+) -> ConformanceReport:
+    """Grades ``adapter``: this library when ``None``, and a command line when a string."""
+    if adapter is None:
+        adapter = LibraryAdapter()
+    elif isinstance(adapter, str):
+        adapter = CommandAdapter(adapter)
+    run = _Run(adapter, directory)
+    clock = system_clock() if now is None else now
+    if "vectors" in suites:
+        run.run_vectors()
+    if "live" in suites:
+        run.run_live(clock)
+    if "scenarios" in suites:
+        run.run_scenarios(clock)
+    return run.report
+
+
+__all__ = [
+    "PROTOCOL",
+    "VECTORS",
+    "Check",
+    "CommandAdapter",
+    "ConformanceReport",
+    "LibraryAdapter",
+    "keys_document",
+    "meets",
+    "published_key_ids",
+    "published_keys",
+    "run_conformance",
+    "scenarios_document",
+    "vector_operation",
+    "vectors",
+]
diff --git a/src/iab_agentic_primitives/web_bot_auth/conformance/__main__.py b/src/iab_agentic_primitives/web_bot_auth/conformance/__main__.py
new file mode 100644
index 0000000..fa799fe
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/conformance/__main__.py
@@ -0,0 +1,102 @@
+"""Command line: ``python -m iab_agentic_primitives.web_bot_auth.conformance``.
+
+- ``adapter [--lines]``: read one operation as JSON on standard input, run it
+  on this library, and write the result as JSON (the protocol in
+  ``PROTOCOL.md`` in this package). With ``--lines``, read and write one JSON
+  object per line until the input ends.
+- ``run [--adapter COMMAND] [--json FILE]``: grade an implementation; exit 1
+  when a check fails.
+- ``--regenerate [--out DIR]``: write the vectors from the generator, and
+  delete the generator's own files it no longer produces; nothing else in
+  DIR is touched. DIR must be a vector directory (empty, or with a
+  ``keys.json``), and the package's own directory is written only in a source
+  checkout. ``--check [--out DIR]`` names each file that differs from the
+  generator, is missing, or is a vector the generator doesn't produce, and
+  exits 1 when there is one. The upstream conformance CLI,
+  ``python -m iab_agentic_primitives.conformance``, names its regeneration the
+  same way.
+"""
+
+from __future__ import annotations
+
+import argparse
+import json
+import sys
+from pathlib import Path
+
+from . import run_conformance
+from .adapter import LibraryAdapter
+
+
+def _parser() -> argparse.ArgumentParser:
+    parser = argparse.ArgumentParser(
+        prog="python -m iab_agentic_primitives.web_bot_auth.conformance"
+    )
+    action = parser.add_mutually_exclusive_group()
+    action.add_argument("--regenerate", action="store_true", help="write the vectors")
+    action.add_argument(
+        "--check", action="store_true", help="exit 1 when a vector file differs from the generator"
+    )
+    parser.add_argument("--out", type=Path, help="the vector directory (default: the package's)")
+    commands = parser.add_subparsers(dest="command")
+    serve = commands.add_parser("adapter", help="run one operation from standard input")
+    serve.add_argument(
+        "--lines", action="store_true", help="run one operation per line until end of input"
+    )
+    run = commands.add_parser("run", help="grade an implementation")
+    run.add_argument("--adapter", help="command line of an adapter; this library when omitted")
+    run.add_argument("--json", type=Path, help="write the checks to this file")
+    return parser
+
+
+def _vectors(args: argparse.Namespace) -> int:
+    from . import generate
+
+    out = args.out or generate.SOURCE
+    if args.check:
+        drift = generate.check(out)
+        for line in drift.lines():
+            print(line)
+        return 1 if drift else 0
+    try:
+        written = generate.write(out)
+    except ValueError as e:
+        print(f"not regenerated: {e}", file=sys.stderr)
+        return 1
+    for path in written:
+        print(f"wrote {path}")
+    return 0
+
+
+def _adapter(lines: bool) -> int:
+    adapter = LibraryAdapter()
+    if not lines:
+        sys.stdout.write(adapter.serve(sys.stdin.read()))
+        return 0
+    for line in sys.stdin:
+        if line.strip():
+            sys.stdout.write(adapter.serve(line) + "\n")
+            sys.stdout.flush()
+    return 0
+
+
+def main(argv: list[str] | None = None) -> int:
+    parser = _parser()
+    args = parser.parse_args(argv)
+    if args.regenerate or args.check:
+        if args.command is not None:
+            parser.error("--regenerate and --check take no command")
+        return _vectors(args)
+    if args.command == "adapter":
+        return _adapter(args.lines)
+    if args.command == "run":
+        report = run_conformance(args.adapter)
+        print(report.render())
+        if args.json:
+            args.json.write_text(json.dumps(report.to_json(), indent=2))
+        return 0 if report.ok else 1
+    parser.error("name a command, or --regenerate or --check")
+
+
+if __name__ == "__main__":
+    sys.exit(main())
diff --git a/src/iab_agentic_primitives/web_bot_auth/conformance/adapter.py b/src/iab_agentic_primitives/web_bot_auth/conformance/adapter.py
new file mode 100644
index 0000000..b4ac7b5
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/conformance/adapter.py
@@ -0,0 +1,208 @@
+"""Adapters: one Web Bot Auth implementation behind the conformance operations.
+
+The operations and their JSON shapes are those of ``PROTOCOL.md`` in this
+package: ``sign_request``, ``sign_directory``, ``verify_request``,
+``verify_directory``, ``sign_response``, and ``verify_response``.
+:class:`LibraryAdapter` runs them on this library; :class:`CommandAdapter`
+runs them on any executable that reads one JSON operation on standard input
+and writes one JSON result. An adapter is a function from an
+:data:`~.models.Operation` to a :data:`~.models.Result`, and it never raises.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import shlex
+import subprocess
+from collections.abc import Callable, Mapping
+
+from pydantic import ValidationError
+
+from ..directory import publish_directory, verify_directory
+from ..errors import ConfigurationError, WebBotAuthError
+from ..keys import Ed25519Key
+from ..replay import MemoryNonceStore
+from ..resolver import DirectoryResolver
+from ..signer import RequestSigner, ResponseSigner, SignerConfig
+from ..testing import served_resolver
+from ..values import Origin, ServerIdentity, UnixSeconds
+from ..verifier import CONFORMANCE_KEYS, RequestVerifier, ResponseVerifier
+from .models import (
+    OPERATION,
+    DirectoryDoc,
+    KeysVerified,
+    Operation,
+    Refused,
+    RequestDoc,
+    ResponseDoc,
+    Result,
+    SignDirectory,
+    SignRequest,
+    SignResponse,
+    Verified,
+    VerifyDirectory,
+    VerifyRequest,
+    VerifyResponse,
+    dump_json,
+    result_of,
+)
+
+#: An implementation behind the protocol: one operation in, one result out, never a raise.
+Adapter = Callable[[Operation], Result]
+
+
+def refused(error: WebBotAuthError) -> Refused:
+    """The result of a refusal: its status, its rule, and its detail."""
+    return Refused(status=error.status, rule=error.reason, error=str(error))
+
+
+def _is_origin(value: str) -> bool:
+    try:
+        Origin.parse(value)
+    except ConfigurationError:
+        return False
+    return True
+
+
+def _resolver(directories: Mapping[str, DirectoryDoc], now: UnixSeconds) -> DirectoryResolver:
+    """A resolver over the operation's directories, fetched through the bounded read at ``now``.
+
+    Only an origin's directory URL is ever fetched; a directory listed under
+    anything else, such as an origin with a port, is never reached.
+    """
+    served = {Origin.parse(o): d.answer() for o, d in directories.items() if _is_origin(o)}
+    return served_resolver(served, clock=lambda: now)
+
+
+def _sign_request(op: SignRequest) -> RequestDoc:
+    config = SignerConfig(Ed25519Key.from_jwk(op.key), op.origin, label=op.label)
+    signer = RequestSigner(config)
+    return RequestDoc.of(signer.sign(op.request.message(), now=op.now))
+
+
+def _sign_directory(op: SignDirectory) -> DirectoryDoc:
+    origin = op.origin
+    answer = publish_directory(origin, [Ed25519Key.from_jwk(k) for k in op.keys], now=op.now)
+    return DirectoryDoc.of(origin.directory_url, answer)
+
+
+def _sign_response(op: SignResponse) -> ResponseDoc:
+    config = SignerConfig(Ed25519Key.from_jwk(op.key), op.origin, label=op.label)
+    signer = ResponseSigner(config)
+    return ResponseDoc.of(signer.sign(op.response.message(op.request.message()), now=op.now))
+
+
+def _verify_directory(op: VerifyDirectory) -> KeysVerified:
+    origin = op.origin
+    fetched = op.response.fetched(origin.directory_url, op.now)
+    directory = verify_directory(fetched, origin, op.now)
+    return KeysVerified(keyids=tuple(sorted(directory.keys)))
+
+
+async def _verify_requests(op: VerifyRequest) -> Result:
+    verifier = RequestVerifier(
+        _resolver(op.directories, op.now),
+        identity=ServerIdentity.from_config(f"https://{op.authority}"),
+        nonces=MemoryNonceStore(clock=lambda: op.now),
+        clock=lambda: op.now,
+        keys=CONFORMANCE_KEYS,
+    )
+    for i, earlier in enumerate(op.prior):
+        try:
+            await verifier.verify(earlier.message())
+        except WebBotAuthError as e:
+            return Refused(status=e.status, rule=f"prior-{i}", error=str(e))
+    verified = await verifier.verify(op.request.message())
+    return Verified(
+        identity=str(verified.origin), keyid=verified.keyid, body_covered=verified.body_covered
+    )
+
+
+def _verify_response(op: VerifyResponse) -> Verified:
+    verifier = ResponseVerifier(
+        _resolver(op.directories, op.now), clock=lambda: op.now, keys=CONFORMANCE_KEYS
+    )
+    expected = op.expected_origin
+    response = op.response.message(op.request.message())
+    verified = asyncio.run(verifier.verify(response, expected_origin=expected))
+    return Verified(identity=str(verified.origin), keyid=verified.keyid, bound=verified.bound)
+
+
+def _run(op: Operation) -> Result:
+    match op:
+        case SignRequest():
+            return _sign_request(op)
+        case SignDirectory():
+            return _sign_directory(op)
+        case SignResponse():
+            return _sign_response(op)
+        case VerifyRequest():
+            return asyncio.run(_verify_requests(op))
+        case VerifyDirectory():
+            return _verify_directory(op)
+        case VerifyResponse():
+            return _verify_response(op)
+
+
+class LibraryAdapter:
+    """Runs the conformance operations on ``iab_agentic_primitives.web_bot_auth``.
+
+    Published test keys are accepted, as the protocol requires of an adapter.
+    A refusal is a :class:`~.models.Refused` with its rule; any other error is
+    an ``adapter-error`` result.
+    """
+
+    def __call__(self, op: Operation) -> Result:
+        try:
+            return _run(op)
+        except WebBotAuthError as e:
+            return refused(e)
+        except Exception as e:  # every failure is a result, never a crash
+            return Refused.adapter_failure("adapter-error", f"{type(e).__name__}: {e}")
+
+    def serve(self, line: str) -> str:
+        """Runs one JSON operation and returns its JSON result, as the CLI adapter does."""
+        try:
+            op = OPERATION.validate_json(line)
+        except ValidationError as e:
+            return dump_json(Refused.adapter_failure("adapter-invalid", str(e)))
+        return dump_json(self(op))
+
+
+class CommandAdapter:
+    """Runs each operation in a new process of ``command``.
+
+    ``command`` is split with :func:`shlex.split` and run without a shell. A
+    timeout, a crash, and an answer that isn't a protocol result each become
+    an adapter result: ``adapter-timeout``, ``adapter-crash`` with the exit
+    code, and ``adapter-invalid``.
+    """
+
+    def __init__(self, command: str, *, timeout: float = 60.0) -> None:
+        self.argv = shlex.split(command)
+        self.timeout = timeout
+
+    def __call__(self, op: Operation) -> Result:
+        try:
+            done = subprocess.run(
+                self.argv,
+                input=dump_json(op),
+                capture_output=True,
+                text=True,
+                timeout=self.timeout,
+                check=False,
+            )
+        except subprocess.TimeoutExpired:
+            return Refused.adapter_failure("adapter-timeout", f"no answer in {self.timeout} s")
+        except OSError as e:
+            return Refused.adapter_failure("adapter-crash", f"can't start {self.argv[0]}: {e}")
+        if done.returncode != 0:
+            detail = (done.stderr or done.stdout).strip()
+            return Refused.adapter_failure("adapter-crash", f"exit {done.returncode}: {detail}")
+        try:
+            return result_of(op, done.stdout)
+        except (ValueError, ValidationError) as e:
+            return Refused.adapter_failure("adapter-invalid", f"{e}: {done.stdout}")
+
+
+__all__ = ["Adapter", "CommandAdapter", "LibraryAdapter", "refused"]
diff --git a/src/iab_agentic_primitives/web_bot_auth/conformance/fixtures.py b/src/iab_agentic_primitives/web_bot_auth/conformance/fixtures.py
new file mode 100644
index 0000000..1f66a77
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/conformance/fixtures.py
@@ -0,0 +1,211 @@
+"""The fixed world of the conformance vectors: seeds, keys, origins, clock, and bodies.
+
+Every key comes from a published seed and every nonce from a seeded byte
+stream, so the generator writes the same bytes on every run.
+"""
+
+from __future__ import annotations
+
+import hashlib
+import json
+from collections.abc import Callable
+from typing import NamedTuple
+
+from cryptography.hazmat.primitives.asymmetric import ec
+
+from ..keys import Ed25519Key
+from ..values import DIRECTORY_PATH, UnixSeconds, b64url_encode
+
+#: The fixed clock: 2026-11-07T12:00:00Z.
+T0 = UnixSeconds(1794052800)
+SEED_PREFIX = "aamp-wba-test/"
+
+
+def at(offset: int) -> UnixSeconds:
+    """The instant ``offset`` seconds after the fixed clock."""
+    return UnixSeconds(T0 + offset)
+
+
+BUYER = "https://buyer.example.com"
+SELLER = "https://seller.example.com"
+OTHER = "https://other.example.com"
+SELLER_AUTHORITY = "seller.example.com"
+COMMIT_URL = f"{SELLER}/proposals/prop_7/commit"
+BUYER_KEYS = f"{BUYER}{DIRECTORY_PATH}"
+SELLER_KEYS = f"{SELLER}{DIRECTORY_PATH}"
+OTHER_KEYS = f"{OTHER}{DIRECTORY_PATH}"
+#: The specification the vectors grade.
+SPEC = "OpenProposal 3.0 § 2.8"
+#: Where the profile's rules are stated; each vector links a heading.
+DOC_URL = "https://github.com/IABTechLab/iab-agentic-primitives/blob/main/WEB_BOT_AUTH.md"
+JSON = {"Content-Type": "application/json"}
+
+
+class TargetUri(NamedTuple):
+    """A URL a ``GET`` is signed for: as a caller writes it, and as it travels on the wire."""
+
+    slug: str
+    name: str
+    url: str
+    wire: str
+
+
+#: The URLs whose ``@target-uri`` the vectors and the target-URI cases grade: the
+#: characters clients send raw, an escape in the path, and RFC 3986 § 6.2.2
+#: normalization.
+TARGET_URIS = (
+    TargetUri(
+        "array-brackets",
+        "Array brackets in the query",
+        f"{SELLER}/proposals?ids[]=1",
+        f"{SELLER}/proposals?ids[]=1",
+    ),
+    TargetUri(
+        "pipe", "A pipe in the query", f"{SELLER}/proposals?f=a|b", f"{SELLER}/proposals?f=a|b"
+    ),
+    TargetUri(
+        "braces",
+        "Braces in the query",
+        f"{SELLER}/proposals?q={{json}}",
+        f"{SELLER}/proposals?q={{json}}",
+    ),
+    TargetUri(
+        "caret", "A caret in the query", f"{SELLER}/proposals?q=a^b", f"{SELLER}/proposals?q=a^b"
+    ),
+    TargetUri(
+        "escaped-space",
+        "An escaped space in the path",
+        f"{SELLER}/proposals/a%20b",
+        f"{SELLER}/proposals/a%20b",
+    ),
+    TargetUri(
+        "default-port",
+        "The default port",
+        "https://seller.example.com:443/proposals/prop_7",
+        f"{SELLER}/proposals/prop_7",
+    ),
+    TargetUri(
+        "mixed-case",
+        "A mixed-case scheme and host",
+        "HTTPS://Seller.Example.COM/proposals/prop_7",
+        f"{SELLER}/proposals/prop_7",
+    ),
+    TargetUri(
+        "dot-segments",
+        "Dot segments in the path",
+        f"{SELLER}/proposals/./x/../prop_7",
+        f"{SELLER}/proposals/prop_7",
+    ),
+)
+
+KEY_SPECS = (
+    ("buyer-request", BUYER),
+    ("other-request", OTHER),
+    ("seller-response", SELLER),
+)
+
+
+def seed(name: str) -> bytes:
+    return hashlib.sha256(f"{SEED_PREFIX}{name}".encode()).digest()
+
+
+def key(name: str) -> Ed25519Key:
+    return Ed25519Key.from_seed(seed(name))
+
+
+def byte_stream(name: str) -> Callable[[int], bytes]:
+    """A deterministic source of bytes for nonces, one stream per name."""
+    counter = 0
+
+    def take(n: int) -> bytes:
+        nonlocal counter
+        out = b""
+        while len(out) < n:
+            out += hashlib.sha512(f"{SEED_PREFIX}nonce/{name}/{counter}".encode()).digest()
+            counter += 1
+        return out[:n]
+
+    return take
+
+
+def nonce(stream: str) -> str:
+    """The first 64 bytes of the stream ``stream``, as unpadded base64url."""
+    return b64url_encode(byte_stream(stream)(64))
+
+
+def compact(value: object) -> bytes:
+    return json.dumps(value, separators=(",", ":")).encode()
+
+
+RECORD_DIGEST = "sha256:" + hashlib.sha256(f"{SEED_PREFIX}record".encode()).hexdigest()
+COMMITMENT_ENTRY = {
+    "role": "commitment",
+    "version": 3,
+    "record_digest": RECORD_DIGEST,
+    "line_item_ids": ["li_1"],
+    "at": "2026-11-07T12:00:00Z",
+    "idempotency_key": "ba1fd8f3-d695-4e8d-8629-ee4073b4f184",  # gitleaks:allow
+}
+COMMIT = {
+    "entry": COMMITMENT_ENTRY,
+    "writes": {
+        "li_1": {
+            "commitment": {
+                "flight": {"start": "2026-12-01T00:00:00Z", "end": "2026-12-31T23:59:59Z"}
+            }
+        }
+    },
+}
+ACCEPTANCE_ENTRY = {
+    "role": "acceptance",
+    "version": 3,
+    "record_digest": RECORD_DIGEST,
+    "line_item_ids": ["li_1"],
+    "at": "2026-11-07T12:00:01Z",
+}
+COMMIT_BODY = compact(COMMIT)
+COMMIT_RESULT_BODY = compact({"entries": [COMMITMENT_ENTRY, ACCEPTANCE_ENTRY]})
+
+
+def p256_public_jwk() -> dict[str, str]:
+    """A P-256 public JWK that the profile doesn't use, for the directory scenarios."""
+    private = ec.derive_private_key(int.from_bytes(seed("p256-unused"), "big"), ec.SECP256R1())
+    numbers = private.public_key().public_numbers()
+    x = b64url_encode(numbers.x.to_bytes(32, "big"))
+    y = b64url_encode(numbers.y.to_bytes(32, "big"))
+    canonical = json.dumps({"crv": "P-256", "kty": "EC", "x": x, "y": y}, separators=(",", ":"))
+    kid = b64url_encode(hashlib.sha256(canonical.encode()).digest())
+    return {"kty": "EC", "crv": "P-256", "x": x, "y": y, "kid": kid, "use": "sig"}
+
+
+__all__ = [
+    "ACCEPTANCE_ENTRY",
+    "BUYER",
+    "BUYER_KEYS",
+    "COMMIT",
+    "COMMITMENT_ENTRY",
+    "COMMIT_BODY",
+    "COMMIT_RESULT_BODY",
+    "COMMIT_URL",
+    "DOC_URL",
+    "JSON",
+    "KEY_SPECS",
+    "OTHER",
+    "OTHER_KEYS",
+    "RECORD_DIGEST",
+    "SEED_PREFIX",
+    "SELLER",
+    "SELLER_AUTHORITY",
+    "SELLER_KEYS",
+    "SPEC",
+    "T0",
+    "TARGET_URIS",
+    "TargetUri",
+    "at",
+    "byte_stream",
+    "compact",
+    "key",
+    "nonce",
+    "p256_public_jwk",
+    "seed",
+]
diff --git a/src/iab_agentic_primitives/web_bot_auth/conformance/generate.py b/src/iab_agentic_primitives/web_bot_auth/conformance/generate.py
new file mode 100644
index 0000000..1e4731f
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/conformance/generate.py
@@ -0,0 +1,866 @@
+"""Generates the conformance vectors deterministically, with the real signers.
+
+Every key comes from a published seed, every nonce from a seeded byte stream,
+and every timestamp from a fixed clock, so running the generator again writes
+the same bytes. Ed25519 is deterministic. Every signature is made by
+:class:`RequestSigner`, :class:`ResponseSigner`, or
+:func:`publish_directory`; a vector that departs from the profile asks
+for it with a :class:`~.signing.MessageDeparture` and is signed raw. Don't
+edit the vector files by hand:
+change this module and regenerate them::
+
+    python -m iab_agentic_primitives.web_bot_auth.conformance --regenerate  # write
+    python -m iab_agentic_primitives.web_bot_auth.conformance --check       # 1 on a difference
+
+:data:`VECTORS_REGISTRY` names each vector's path and tier once, with its builder.
+"""
+
+from __future__ import annotations
+
+import json
+import re
+from collections.abc import Callable
+from dataclasses import dataclass, field, replace
+from functools import cache
+from pathlib import Path
+from typing import Literal, TypedDict, Unpack
+
+from .._unchecked import signature_base
+from ..directory import publish_directory
+from ..errors import Refusal
+from ..keys import Ed25519Key
+from ..message import HTTPRequest, HTTPResponse
+from ..rules import REQUEST, RESPONSE, SIGNATURE_TAG, signature_agent_component
+from ..signer import RequestSigner, ResponseSigner, SignerConfig
+from ..values import DIRECTORY_MEDIA_TYPE, OMIT, Origin, UnixSeconds, parse_authority
+from . import VECTORS
+from .fixtures import (
+    BUYER,
+    BUYER_KEYS,
+    COMMIT_BODY,
+    COMMIT_RESULT_BODY,
+    COMMIT_URL,
+    DOC_URL,
+    JSON,
+    KEY_SPECS,
+    OTHER,
+    OTHER_KEYS,
+    SEED_PREFIX,
+    SELLER,
+    SELLER_AUTHORITY,
+    SPEC,
+    T0,
+    TARGET_URIS,
+    TargetUri,
+    at,
+    key,
+    nonce,
+)
+from .models import (
+    AcceptSignature,
+    DirectoryDoc,
+    KeyEntry,
+    KeysDocument,
+    Passes,
+    RefusalEntry,
+    RefusalsDocument,
+    Refuses,
+    ReplayEntry,
+    RequestDoc,
+    ResponseDoc,
+    SignatureParameters,
+    Tier,
+    Vector,
+    VectorOperation,
+    VerifyDirectory,
+    VerifyRequest,
+    VerifyResponse,
+    dump,
+    passing,
+    refusing,
+)
+from .scenarios import build_scenarios
+from .signing import MessageDeparture, RawSigner, sign_directory
+
+#: Where regeneration writes by default: the package's own vector directory.
+SOURCE = Path(str(VECTORS))
+
+
+# ── keys.json and refusals.json ────────────────────────────────────────────
+
+
+def keys_document() -> KeysDocument:
+    entries = []
+    for name, identity in KEY_SPECS:
+        k = key(name)
+        jwk = k.public_jwk()
+        entry = KeyEntry(
+            identity=Origin.parse(identity),
+            seed_name=name,
+            kty="OKP",
+            crv="Ed25519",
+            kid=k.thumbprint,
+            x=str(jwk["x"]),
+            use="sig",
+            private_d=str(k.private_jwk()["d"]),
+        )
+        entries.append(entry)
+    return KeysDocument(
+        comment=(
+            "Public test keys for the Web Bot Auth profile conformance vectors. The private "
+            "seeds are published so that implementations can reproduce every signature. Each "
+            f"seed is SHA-256 of the ASCII string '{SEED_PREFIX}<seed_name>'. Web Bot Auth "
+            "section 6.8: test keys MUST NOT be used in production, and verifiers SHOULD reject "
+            "them when detected. Each kid is the RFC 7638 JWK thumbprint (RFC 8037 Appendix A.3 "
+            "for Ed25519). Each entry's identity is the origin whose key directory publishes "
+            "the key."
+        ),
+        keys=tuple(entries),
+    )
+
+
+def refusals_document() -> RefusalsDocument:
+    return RefusalsDocument(
+        comment=(
+            "The refusal vocabulary: every rule a verifier refuses with, and its status. "
+            "Generated from the Refusal enum; a harness grades a refusal by its rule and status."
+        ),
+        refusals=tuple(RefusalEntry(rule=r.code, status=r.status) for r in Refusal),
+    )
+
+
+# ── signed messages ────────────────────────────────────────────────────────
+
+
+def _buyer() -> Ed25519Key:
+    return key("buyer-request")
+
+
+def _commit_request() -> HTTPRequest:
+    return HTTPRequest("POST", COMMIT_URL, JSON, COMMIT_BODY)
+
+
+def _signed(
+    origin: str,
+    stream: str,
+    departure: MessageDeparture | None = None,
+    config: SignerConfig | None = None,
+) -> HTTPRequest:
+    """The buyer's commit, signed as ``origin`` with the nonce of ``stream``.
+
+    With no ``departure``, :class:`RequestSigner` signs it. A departure signs
+    it raw; the nonce of ``stream`` stands unless the departure sets one.
+    """
+    config = config or SignerConfig(_buyer(), Origin.parse(origin))
+    if departure is None:
+        return RequestSigner(config).sign(_commit_request(), now=T0, nonce=nonce(stream))
+    parameters = SignatureParameters(nonce=nonce(stream)).merged(departure.parameters)
+    raw = RawSigner(config, replace(departure, parameters=parameters))
+    return raw.request(_commit_request(), T0)
+
+
+def _bases(message: HTTPRequest | HTTPResponse, *signers: tuple[str, Ed25519Key]) -> dict[str, str]:
+    return {label: signature_base(message, label, k).decode() for label, k in signers}
+
+
+@cache
+def _commit_001() -> HTTPRequest:
+    """The buyer's signed commit, positive/001: also replayed and verified before others."""
+    return _signed(BUYER, "001")
+
+
+def _seller_response(departure: MessageDeparture | None = None) -> HTTPResponse:
+    response = HTTPResponse(200, JSON, COMMIT_RESULT_BODY, _commit_001())
+    config = SignerConfig(key("seller-response"), Origin.parse(SELLER))
+    if departure is None:
+        return ResponseSigner(config).sign(response, now=at(1))
+    return RawSigner(config, departure).response(response, at(1))
+
+
+def _directories(*pairs: tuple[str, str]) -> dict[str, Ed25519Key]:
+    """Each origin's directory, published with its one key."""
+    return {origin: key(name) for origin, name in pairs}
+
+
+_BUYER_DIRECTORY = _directories((BUYER, "buyer-request"))
+_PARAMETER_NAMES = ("created", "expires", "nonce", "keyid", "alg", "tag")
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class _Exchange:
+    """What a vector sends a verifier: the message, and what the verifier is held to.
+
+    ``authority`` is the verifier's own for a request, and the origin's host
+    for a response or a directory.
+    """
+
+    kind: Literal["request", "response", "directory"]
+    authority: str
+    request: RequestDoc
+    response: ResponseDoc | None = None
+    directories: dict[str, Ed25519Key] = field(default_factory=dict)
+    prior: tuple[RequestDoc, ...] = ()
+
+    def operation(self, now: UnixSeconds) -> VectorOperation:
+        """The one operation that grades the vector, its directories signed at ``now``."""
+        signed = {o: sign_directory([k], o, now) for o, k in self.directories.items()}
+        origin = Origin.parse(f"https://{self.authority}")
+        if self.kind == "request":
+            verifier = parse_authority(self.authority)
+            return VerifyRequest(
+                request=self.request,
+                authority=verifier,
+                directories=signed,
+                now=now,
+                prior=self.prior,
+            )
+        if self.response is None:
+            raise ValueError(f"a {self.kind} vector has a response")
+        if self.kind == "response":
+            return VerifyResponse(
+                request=self.request,
+                response=self.response,
+                directories=signed,
+                now=now,
+                expected_origin=origin,
+            )
+        r = self.response
+        fetched = DirectoryDoc(status=r.status, headers=r.headers, body=r.body)
+        return VerifyDirectory(origin=origin, response=fetched, now=now)
+
+
+class _About(TypedDict, total=False):
+    """What a vector says about its exchange."""
+
+    name: str
+    tier: Tier
+    spec: str
+    spec_reference: str
+    reference_now: UnixSeconds
+    expected: Passes | Refuses
+    expected_signature_base: dict[str, str]
+    replay_cache_entries: tuple[ReplayEntry, ...]
+    comment: str
+
+
+def _vector(exchange: _Exchange, **about: Unpack[_About]) -> Vector:
+    """The vector of ``exchange``, graded at its ``reference_now``."""
+    now = about["reference_now"]
+    return Vector(
+        name=about["name"],
+        tier=about["tier"],
+        spec=about["spec"],
+        spec_reference=about["spec_reference"],
+        reference_now=now,
+        operation=exchange.operation(now),
+        replay_cache_entries=about.get("replay_cache_entries", ()),
+        expected_signature_base=about.get("expected_signature_base"),
+        expected=about["expected"],
+        comment=about["comment"],
+    )
+
+
+def _accept(*, nonce: bool = False) -> AcceptSignature:
+    return AcceptSignature(
+        label="sig1",
+        components="(" + " ".join(map(str, REQUEST.components("sig1", has_body=True))) + ")",
+        parameters=_PARAMETER_NAMES,
+        tag=SIGNATURE_TAG,
+        nonce="verifier-chosen" if nonce else None,
+    )
+
+
+def _ref(heading: str) -> str:
+    return f"{DOC_URL}#{heading}"
+
+
+# ── the vectors, one builder each ──────────────────────────────────────────
+
+
+def _positive_001(tier: Tier) -> Vector:
+    request = _commit_001()
+    return _vector(
+        _Exchange(
+            kind="request",
+            authority=SELLER_AUTHORITY,
+            request=RequestDoc.of(request),
+            directories=_BUYER_DIRECTORY,
+        ),
+        name=f"Single signer: the buyer agent at {BUYER} commits to proposal prop_7",
+        tier=tier,
+        spec=SPEC,
+        spec_reference=_ref("profile-rules"),
+        reference_now=at(10),
+        expected_signature_base=_bases(request, ("sig1", _buyer())),
+        expected=passing(BUYER),
+        comment=(
+            f"The Signature-Agent member sig1 names the key directory URL {BUYER_KEYS}, so the "
+            "verifier fetches it, selects the key whose kid equals keyid, and attributes the "
+            f"request to the origin {BUYER}. Ed25519 is deterministic, so an implementation "
+            "signing expected_signature_base with the published seed reproduces the Signature "
+            "value byte for byte."
+        ),
+    )
+
+
+def _positive_002(tier: Tier) -> Vector:
+    buyer = _buyer()
+    origin = Origin.parse(BUYER)
+    authority = origin.authority
+    published = publish_directory(origin, [buyer], now=at(-600))
+    request = HTTPRequest("GET", BUYER_KEYS, {"Host": authority, "Accept": DIRECTORY_MEDIA_TYPE})
+    signed = HTTPResponse(
+        published.status, published.headers, published.body, HTTPRequest("GET", BUYER_KEYS)
+    )
+    return _vector(
+        _Exchange(
+            kind="directory",
+            authority=authority,
+            request=RequestDoc.of(request),
+            response=ResponseDoc.of(signed),
+        ),
+        name=f"Signed key directory response for {BUYER}, one signature per key",
+        tier=tier,
+        spec=SPEC,
+        spec_reference=_ref("profile-rules"),
+        reference_now=at(10),
+        expected_signature_base=_bases(signed, ("key1", buyer)),
+        expected=passing(),
+        comment=(
+            "Web Bot Auth Appendix B.1: the directory server signs the response once per key, "
+            'covering "@authority";req and content-digest, with created, expires, the key\'s '
+            "thumbprint as keyid, and tag http-message-signatures-directory. The verifier "
+            "validates the signature with the key the directory itself provides and validates "
+            "Content-Digest against the body. Covering the request authority stops the key set "
+            "from being served again from another domain."
+        ),
+    )
+
+
+def _response_vector(tier: Tier, response: HTTPResponse, expected: Passes | Refuses) -> Vector:
+    return _vector(
+        _Exchange(
+            kind="response",
+            authority=SELLER_AUTHORITY,
+            request=RequestDoc.of(response.request),
+            response=ResponseDoc.of(response),
+            directories=_directories((SELLER, "seller-response")),
+        ),
+        name=(
+            f"The seller at {SELLER} answers the commit with a CommitResult, bound to the signed "
+            "request"
+        ),
+        tier=tier,
+        spec=SPEC,
+        spec_reference=_ref("profile-rules"),
+        reference_now=at(10),
+        expected_signature_base=_bases(response, ("sig1", key("seller-response"))),
+        expected=expected,
+        comment=(
+            'The response covers "signature";req;key="sig1", the request\'s own signature, so '
+            "it answers that exact request (RFC 9421 section 2.4). It carries no nonce: the "
+            "binding gives freshness."
+        ),
+    )
+
+
+def _positive_003(tier: Tier) -> Vector:
+    return _response_vector(tier, _seller_response(), passing(SELLER))
+
+
+def _positive_004(tier: Tier) -> Vector:
+    origin_form = MessageDeparture(signature_agent=f'sig1="{BUYER}"')
+    request = _signed(BUYER, "001-origin", origin_form)
+    return _vector(
+        _Exchange(
+            kind="request",
+            authority=SELLER_AUTHORITY,
+            request=RequestDoc.of(request),
+            directories=_BUYER_DIRECTORY,
+        ),
+        name=f"Draft -00 form: Signature-Agent names the bare origin {BUYER}",
+        tier=tier,
+        spec=SPEC,
+        spec_reference=_ref("profile-rules"),
+        reference_now=at(10),
+        expected_signature_base=_bases(request, ("sig1", _buyer())),
+        expected=passing(BUYER),
+        comment=(
+            f"A draft -00 signer names its origin. The verifier constructs {BUYER_KEYS}, the "
+            "same URL a key URL member names, fetches it, and attributes the request to the same "
+            "origin."
+        ),
+    )
+
+
+def _negative_001(tier: Tier) -> Vector:
+    without_nonce = MessageDeparture(parameters=SignatureParameters(nonce=None))
+    request = _signed(BUYER, "none", without_nonce)
+    return _vector(
+        _Exchange(
+            kind="request",
+            authority=SELLER_AUTHORITY,
+            request=RequestDoc.of(request),
+            directories=_BUYER_DIRECTORY,
+        ),
+        name="Signature-Input omits the nonce parameter",
+        tier=tier,
+        spec=SPEC,
+        spec_reference=_ref("verification-procedure"),
+        reference_now=at(10),
+        expected_signature_base=_bases(request, ("sig1", _buyer())),
+        expected=refusing(
+            Refusal.NONCE_MISSING,
+            accept_signature=_accept(),
+            rationale=(
+                "The profile requires an RFC 9421 nonce on every signed request. Without one the "
+                "verifier cannot detect replay."
+            ),
+        ),
+        comment=(
+            "The signature is cryptographically valid over its covered components, so a "
+            "verifier that does not enforce the nonce requirement accepts it."
+        ),
+    )
+
+
+def _negative_002(tier: Tier) -> Vector:
+    request = _commit_001()
+    first_nonce = nonce("001")
+    return _vector(
+        _Exchange(
+            kind="request",
+            authority=SELLER_AUTHORITY,
+            request=RequestDoc.of(request),
+            directories=_BUYER_DIRECTORY,
+            prior=(RequestDoc.of(request),),
+        ),
+        name=(
+            "Second submission of a request whose (identity, nonce) pair the verifier has "
+            "already accepted"
+        ),
+        tier=tier,
+        spec=SPEC,
+        spec_reference=_ref("verification-procedure"),
+        reference_now=at(15),
+        replay_cache_entries=(
+            ReplayEntry(identity=Origin.parse(BUYER), nonce=first_nonce, ttl_seconds=360),
+        ),
+        expected_signature_base=_bases(request, ("sig1", _buyer())),
+        expected=refusing(
+            Refusal.NONCE_REPLAYED,
+            accept_signature=_accept(nonce=True),
+            rationale=(
+                "The verifier MUST reject a nonce it has already seen for the same identity "
+                "within the signature's lifetime."
+            ),
+        ),
+        comment=(
+            "The request is byte-identical to positive/001-single-signer-request.json. A "
+            "black-box runner verifies prior.verified_requests first, then this request; a "
+            "white-box harness injects prior.replay_cache_entries instead."
+        ),
+    )
+
+
+def _negative_003(tier: Tier) -> Vector:
+    uncovered = tuple(
+        c
+        for c in REQUEST.components("sig1", has_body=True)
+        if c != signature_agent_component("sig1")
+    )
+    request = _signed(BUYER, "003", MessageDeparture(components=uncovered))
+    return _vector(
+        _Exchange(
+            kind="request",
+            authority=SELLER_AUTHORITY,
+            request=RequestDoc.of(request),
+            directories=_BUYER_DIRECTORY,
+        ),
+        name="Signature-Agent header present, but the sig1 member is not a covered component",
+        tier=tier,
+        spec=SPEC,
+        spec_reference=_ref("profile-rules"),
+        reference_now=at(10),
+        expected_signature_base=_bases(request, ("sig1", _buyer())),
+        expected=refusing(
+            Refusal.SIGNATURE_AGENT_NOT_COVERED,
+            accept_signature=_accept(),
+            rationale=(
+                "Web Bot Auth section 5.2.1: the Signature-Agent member keyed to the signature "
+                "label MUST be signed as a component. An uncovered member is an unverified claim "
+                "(section 4.1)."
+            ),
+        ),
+        comment=(
+            "The signature verifies over the components it does cover, so a verifier that reads "
+            "the identity from the uncovered header and skips the coverage check attributes the "
+            "request to an origin nobody signed for."
+        ),
+    )
+
+
+@cache
+def _signed_for_other() -> HTTPRequest:
+    """The buyer's key signs while Signature-Agent names the other origin."""
+    return _signed(OTHER, "004")
+
+
+_KEY_LOOKUP = (
+    "Key lookup is keyed on the (origin, keyid) pair, never on keyid alone (Web Bot Auth "
+    "section 5.4)."
+)
+
+
+def _negative_004(tier: Tier) -> Vector:
+    request = _signed_for_other()
+    return _vector(
+        _Exchange(
+            kind="request",
+            authority=SELLER_AUTHORITY,
+            request=RequestDoc.of(request),
+            directories=_directories((OTHER, "other-request"), (BUYER, "buyer-request")),
+        ),
+        name=f"Signature-Agent names {OTHER}, but the signing key is published only by {BUYER}",
+        tier=tier,
+        spec=SPEC,
+        spec_reference=_ref("profile-rules"),
+        reference_now=at(10),
+        expected_signature_base=_bases(request, ("sig1", _buyer())),
+        expected=refusing(
+            Refusal.KEY_NOT_FOUND,
+            accept_signature=_accept(),
+            rationale=f"{_KEY_LOOKUP} The directory at the named origin holds no key with this "
+            "thumbprint.",
+        ),
+        comment=(
+            "The signature is valid under the buyer's key, and directories lists that key under "
+            "its own origin so a harness can show the trap: a verifier that indexes keys by "
+            f"thumbprint alone finds the key and attributes the request to {OTHER}, an origin "
+            "that never published it."
+        ),
+    )
+
+
+def _negative_005(tier: Tier) -> Vector:
+    request = _commit_001()
+    malformed = dict(request.headers.items())
+    malformed["Signature-Agent"] = f'sig1="{BUYER_KEYS}'
+    malformed["Signature"] = "sig1=:" + "A" * 86 + "==:"
+    return _vector(
+        _Exchange(
+            kind="request",
+            authority=SELLER_AUTHORITY,
+            request=RequestDoc.of(
+                HTTPRequest(request.method, request.url, malformed, request.body)
+            ),
+            directories=_BUYER_DIRECTORY,
+        ),
+        name=(
+            "Signature-Agent is not a parseable Structured Field Dictionary (unterminated string)"
+        ),
+        tier=tier,
+        spec=SPEC,
+        spec_reference=_ref("verification-procedure"),
+        reference_now=at(10),
+        expected=refusing(
+            Refusal.PARSE,
+            rationale=(
+                "Web Bot Auth section 5.4: a verifier that fails to parse Signature, "
+                "Signature-Input, or Signature-Agent answers 400 Bad Request."
+            ),
+        ),
+        comment=(
+            "Signature is a 64-zero-byte placeholder: parsing fails before any key is resolved "
+            "or any signature is checked, so a verifier that reaches cryptographic verification "
+            "has skipped the parse step."
+        ),
+    )
+
+
+def _negative_006(tier: Tier) -> Vector:
+    both = MessageDeparture(signature_agent=f'sig1="{BUYER_KEYS}", sig2="{OTHER_KEYS}"')
+    first = _signed(BUYER, "001", both)
+    other = key("other-request")
+    beside = MessageDeparture(
+        parameters=SignatureParameters(nonce=nonce("006")),
+        signature_agent=OMIT,
+        keep_signatures=True,
+    )
+    second = RawSigner(SignerConfig(other, Origin.parse(OTHER), label="sig2"), beside).request(
+        first, T0
+    )
+    return _vector(
+        _Exchange(
+            kind="request",
+            authority=SELLER_AUTHORITY,
+            request=RequestDoc.of(second),
+            directories=_directories((BUYER, "buyer-request"), (OTHER, "other-request")),
+        ),
+        name=(
+            "Two web-bot-auth signatures on one request: positive/001 plus a second valid "
+            f"signature from {OTHER}"
+        ),
+        tier=tier,
+        spec=SPEC,
+        spec_reference=_ref("verification-procedure"),
+        reference_now=at(10),
+        expected_signature_base=_bases(second, ("sig1", _buyer()), ("sig2", other)),
+        expected=refusing(
+            Refusal.MULTIPLE_SIGNATURES,
+            accept_signature=_accept(),
+            rationale=(
+                "The profile takes exactly one web-bot-auth signature and one Signature-Agent "
+                "member per request. Web Bot Auth section 5.2.2 permits more than one "
+                "signature; the profile does not accept one."
+            ),
+        ),
+        comment=(
+            "The sig1 label is byte-identical to positive/001, and sig2 is a second valid "
+            "signature over the same request from another identity. A verifier that accepts "
+            "when each label verifies skips the count check."
+        ),
+    )
+
+
+def _negative_007(tier: Tier) -> Vector:
+    unbound = MessageDeparture(components=RESPONSE.components("sig1", has_body=True))
+    expected = refusing(
+        Refusal.RESPONSE_NOT_BOUND,
+        rationale=(
+            'A response to a request that carried a web-bot-auth signature covers "signature";'
+            "req;key=<request label>. Without it, the response could answer any request."
+        ),
+    )
+    vector = _response_vector(tier, _seller_response(unbound), expected)
+    return replace(
+        vector,
+        name="The seller's response to a signed request, not bound to that request",
+        comment=(
+            "The response signature is valid over its covered components, so a verifier that "
+            "does not check the binding accepts a response that could have been captured from "
+            "another exchange."
+        ),
+    )
+
+
+def _negative_008(tier: Tier) -> Vector:
+    request = _signed_for_other()
+    return _vector(
+        _Exchange(
+            kind="request",
+            authority=SELLER_AUTHORITY,
+            request=RequestDoc.of(request),
+            directories=_directories((OTHER, "other-request"), (BUYER, "buyer-request")),
+            prior=(RequestDoc.of(_commit_001()),),
+        ),
+        name=(
+            f"negative/004 after a verified request from {BUYER}: the warm cache still keys on "
+            "(origin, keyid)"
+        ),
+        tier=tier,
+        spec=SPEC,
+        spec_reference=_ref("profile-rules"),
+        reference_now=at(10),
+        expected_signature_base=_bases(request, ("sig1", _buyer())),
+        expected=refusing(
+            Refusal.KEY_NOT_FOUND,
+            accept_signature=_accept(),
+            rationale=f"{_KEY_LOOKUP} It holds with or without a cached directory.",
+        ),
+        comment=(
+            "The verifier first verifies positive/001-single-signer-request.json, so the "
+            f"directory of {BUYER} is cached when this request arrives. A verifier whose cache "
+            "answers any lookup from any cached directory finds the buyer's key there and "
+            f"attributes the request to {OTHER}."
+        ),
+    )
+
+
+def _target_uri_vector(target: TargetUri) -> Callable[[Tier], Vector]:
+    """The builder of the vector that signs a ``GET`` to ``target.url``."""
+
+    def build(tier: Tier) -> Vector:
+        config = SignerConfig(_buyer(), Origin.parse(BUYER))
+        stream = f"target-uri/{target.slug}"
+        signed = RequestSigner(config).sign(
+            HTTPRequest("GET", target.url), now=T0, nonce=nonce(stream)
+        )
+        if signed.url != target.wire:
+            raise ValueError(f"{target.url} is signed as {signed.url}, not {target.wire}")
+        # The vector carries the URL as a caller writes it, so a verifier applies the rule.
+        request = replace(signed, url=target.url)
+        return _vector(
+            _Exchange(
+                kind="request",
+                authority=SELLER_AUTHORITY,
+                request=RequestDoc.of(request),
+                directories=_BUYER_DIRECTORY,
+            ),
+            name=f"@target-uri: {target.name.lower()}, {target.url}",
+            tier=tier,
+            spec=SPEC,
+            spec_reference=_ref("the-target-uri"),
+            reference_now=at(10),
+            expected_signature_base=_bases(request, ("sig1", _buyer())),
+            expected=passing(BUYER),
+            comment=(
+                f"The buyer signs a GET to {target.url}, and the request carries that URL as a "
+                f"caller writes it. Its @target-uri is {target.wire}: the URL as an HTTP client "
+                "sends it and a server receives it, the WHATWG URL serialization normalized per "
+                "RFC 3986 section 6.2.2 (lowercase scheme and host, no default port, no dot "
+                "segments), with every character a client sends raw left as written. A verifier "
+                "that parses the URL with a stricter grammar, re-encodes it, or skips the "
+                "normalization computes another signature base and refuses a valid request."
+            ),
+        )
+
+    return build
+
+
+@dataclass(frozen=True)
+class VectorEntry:
+    """One committed vector: its path under the vector directory, its tier, and its builder."""
+
+    path: str
+    tier: Tier
+    build: Callable[[Tier], Vector]
+
+
+#: Every vector, its path and tier stated once. ``tier`` is what the bare
+#: reference libraries answer: "wba" when they already give the expected
+#: outcome, "profile" when only the profile's rules do.
+VECTORS_REGISTRY: tuple[VectorEntry, ...] = (
+    VectorEntry("positive/001-single-signer-request.json", "wba", _positive_001),
+    VectorEntry("positive/002-signed-directory-response.json", "wba", _positive_002),
+    VectorEntry("positive/003-signed-response.json", "wba", _positive_003),
+    VectorEntry("positive/004-origin-form-request.json", "wba", _positive_004),
+    *(
+        VectorEntry(f"positive/{i:03}-target-uri-{t.slug}.json", "wba", _target_uri_vector(t))
+        for i, t in enumerate(TARGET_URIS, 5)
+    ),
+    VectorEntry("negative/001-missing-nonce.json", "profile", _negative_001),
+    VectorEntry("negative/002-replayed-nonce.json", "profile", _negative_002),
+    VectorEntry("negative/003-signature-agent-not-covered.json", "wba", _negative_003),
+    VectorEntry("negative/004-key-not-in-named-directory.json", "wba", _negative_004),
+    VectorEntry("negative/005-malformed-signature-agent.json", "wba", _negative_005),
+    VectorEntry("negative/006-two-signatures.json", "wba", _negative_006),
+    VectorEntry("negative/007-response-not-bound.json", "profile", _negative_007),
+    VectorEntry("negative/008-key-not-in-named-directory-warm-cache.json", "wba", _negative_008),
+)
+
+
+# ── writing ────────────────────────────────────────────────────────────────
+
+
+def documents() -> dict[str, object]:
+    """Every generated file, keyed by its path under the vector directory."""
+    return {
+        "keys.json": keys_document(),
+        "refusals.json": refusals_document(),
+        "scenarios.json": build_scenarios(),
+        **{entry.path: entry.build(entry.tier) for entry in VECTORS_REGISTRY},
+    }
+
+
+#: A field line as indent=2 spreads it: ``[``, the name, the value, and ``]``.
+_FIELD_LINE = re.compile(r'\[\n\s+("(?:[^"\\]|\\.)*"),\n\s+("(?:[^"\\]|\\.)*")\n\s+\]')
+
+
+def render(document: object) -> str:
+    """The JSON text of a generated file, with each field line on one line."""
+    text = json.dumps(dump(document), indent=2, ensure_ascii=False)
+    return _FIELD_LINE.sub(r"[\1, \2]", text) + "\n"
+
+
+#: The files the generator owns at the top of a vector directory.
+_TOP = ("keys.json", "refusals.json", "scenarios.json")
+
+
+def _committed(directory: Path) -> set[str]:
+    """The generator's own files under ``directory``: the three top-level documents and
+    the vectors in ``positive/`` and ``negative/``. Nothing else is ever touched."""
+    vectors = (p for group in ("positive", "negative") for p in (directory / group).glob("*.json"))
+    found = {p.relative_to(directory).as_posix() for p in vectors}
+    return found | {name for name in _TOP if (directory / name).exists()}
+
+
+def _source_checkout(directory: Path) -> bool:
+    """True when ``directory`` is in a source tree, not an installed package."""
+    return any((parent / "pyproject.toml").exists() for parent in directory.resolve().parents)
+
+
+def _checked_target(directory: Path) -> None:
+    """Refuses a directory that isn't a vector directory, and an installed package's."""
+    if directory.exists() and any(directory.iterdir()) and not (directory / "keys.json").exists():
+        raise ValueError(f"{directory} is not a vector directory: it has files and no keys.json")
+    if directory.resolve() == SOURCE.resolve() and not _source_checkout(directory):
+        raise ValueError(f"{directory} is an installed package; regenerate in a source checkout")
+
+
+def write(directory: Path = SOURCE) -> list[Path]:
+    """Writes every generated file under ``directory`` and deletes its own stale vectors.
+
+    Only the generator's layout is written or deleted; any other file there is
+    left alone. Raises ``ValueError`` for a directory that isn't a vector
+    directory, and for the package's own directory outside a source checkout.
+    """
+    _checked_target(directory)
+    generated = documents()
+    for stale in sorted(_committed(directory) - set(generated)):
+        (directory / stale).unlink()
+    written = []
+    for relative, document in generated.items():
+        path = directory / relative
+        path.parent.mkdir(parents=True, exist_ok=True)
+        path.write_text(render(document))
+        written.append(path)
+    return written
+
+
+@dataclass(frozen=True, slots=True)
+class Drift:
+    """How a vector directory departs from the generator, file by file."""
+
+    differs: tuple[str, ...]
+    missing: tuple[str, ...]
+    unknown: tuple[str, ...]
+
+    def __bool__(self) -> bool:
+        return bool(self.differs or self.missing or self.unknown)
+
+    def lines(self) -> list[str]:
+        """One line per file: what is wrong with it, and its path."""
+        return [
+            *(f"differs from the generator: {name}" for name in self.differs),
+            *(f"missing: {name}" for name in self.missing),
+            *(f"not generated: {name}" for name in self.unknown),
+        ]
+
+
+def check(directory: Path = SOURCE) -> Drift:
+    """The files under ``directory`` that differ from the generator, are missing, or are its
+    own kind of file but not generated."""
+    generated = documents()
+    missing = tuple(r for r in generated if not (directory / r).exists())
+    differs = tuple(
+        r
+        for r, document in generated.items()
+        if r not in missing and (directory / r).read_text() != render(document)
+    )
+    unknown = tuple(sorted(_committed(directory) - set(generated)))
+    return Drift(differs, missing, unknown)
+
+
+__all__ = [
+    "SOURCE",
+    "VECTORS_REGISTRY",
+    "Drift",
+    "VectorEntry",
+    "check",
+    "documents",
+    "keys_document",
+    "refusals_document",
+    "render",
+    "write",
+]
diff --git a/src/iab_agentic_primitives/web_bot_auth/conformance/models.py b/src/iab_agentic_primitives/web_bot_auth/conformance/models.py
new file mode 100644
index 0000000..932b97d
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/conformance/models.py
@@ -0,0 +1,857 @@
+"""The conformance documents as frozen, typed models.
+
+``keys.json``, ``scenarios.json``, ``refusals.json``, each vector, each adapter
+operation (``PROTOCOL.md``), and each result validate when they are read, in
+Pydantic's strict mode: a boolean is a JSON ``true`` or ``false``, an integer
+is a JSON integer, and a member nobody declared is refused (a result may
+carry extra members). Identities validate as :class:`~..values.Origin` and
+authorities as :data:`~..values.RequestAuthority`.
+
+A sum is a union discriminated by a member, never a product of optional
+fields: an outcome is a :class:`Passes` or a :class:`Refuses`, on ``ok``, and
+a vector's operation is one of the three verify operations, on ``op``. A
+refusal names its rule, and its status is the rule's.
+
+Each model is a frozen, slotted, keyword-only dataclass, like the rest of the
+module: :func:`read` reads JSON into a model, and :func:`dump` writes one back.
+"""
+
+from __future__ import annotations
+
+import base64
+import enum
+import json
+from collections.abc import Mapping
+from dataclasses import dataclass, field, fields, replace
+from typing import Annotated, ClassVar, Final, Literal, TypeVar, cast, get_args
+
+from pydantic import (
+    ConfigDict,
+    Discriminator,
+    Field,
+    PlainSerializer,
+    PlainValidator,
+    Tag,
+    TypeAdapter,
+    model_serializer,
+    model_validator,
+)
+
+from ..directory import DirectoryResponse
+from ..errors import Refusal, Status
+from ..keys import PrivateJwk
+from ..message import Answer, HeaderLines, HTTPRequest, HTTPResponse
+from ..values import Origin, RequestAuthority, UnixSeconds, parse_authority
+
+#: ``wba``: the bare reference libraries already give the expected outcome.
+#: ``profile``: only the profile's rules give it.
+Tier = Literal["profile", "wba"]
+#: The suites a runner grades.
+Suite = Literal["vectors", "live", "scenarios"]
+
+
+T = TypeVar("T")
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class Model:
+    """A conformance document, read strictly, with no member it doesn't declare."""
+
+    __pydantic_config__: ClassVar[ConfigDict] = ConfigDict(extra="forbid", strict=True)
+
+
+#: One validator per model, built on first use.
+_ADAPTERS: dict[object, object] = {}
+
+
+def _adapter(kind: object) -> TypeAdapter[T]:
+    found = _ADAPTERS.get(kind)
+    if found is None:
+        found = _ADAPTERS[kind] = TypeAdapter(kind)
+    return cast(TypeAdapter[T], found)
+
+
+def read[T](kind: type[T], text: str | bytes) -> T:
+    """Reads the JSON ``text`` as a ``kind``; ``pydantic.ValidationError`` when it isn't one."""
+    adapter: TypeAdapter[T] = _adapter(kind)
+    return adapter.validate_json(text)
+
+
+def dump(document: object) -> object:
+    """The JSON data of a model, with its aliases and without the fields left unset."""
+    adapter: TypeAdapter[object] = _adapter(type(document))
+    return adapter.dump_python(document, mode="json", by_alias=True, exclude_none=True)
+
+
+def dump_json(document: object) -> str:
+    return json.dumps(dump(document))
+
+
+def _refusal(value: object) -> Refusal:
+    if isinstance(value, Refusal):
+        return value
+    if isinstance(value, str):
+        return Refusal.of(value)
+    raise ValueError(f"a rule is a refusal reason code, not {value!r}")
+
+
+def _code(refusal: Refusal) -> str:
+    return refusal.code
+
+
+#: A refusal, written as its reason code, such as ``"nonce-missing"``.
+Rule = Annotated[Refusal, PlainValidator(_refusal), PlainSerializer(_code, return_type=str)]
+
+
+def _status(value: object) -> Status:
+    if type(value) is not int or value not in get_args(Status):
+        raise ValueError(f"a status is one of {get_args(Status)}, not {value!r}")
+    return cast(Status, value)
+
+
+#: A refusal status, a JSON integer among 400, 403, 429, and 503.
+StatusCode = Annotated[Status, PlainValidator(_status), PlainSerializer(int, return_type=int)]
+
+
+def _true(value: object) -> Literal[True]:
+    if value is not True:
+        raise ValueError(f"ok is the JSON boolean true here, not {value!r}")
+    return True
+
+
+def _false(value: object) -> Literal[False]:
+    if value is not False:
+        raise ValueError(f"ok is the JSON boolean false here, not {value!r}")
+    return False
+
+
+#: ``ok`` on a pass: the JSON boolean ``true``, not a value equal to it.
+OkTrue = Annotated[Literal[True], PlainValidator(_true)]
+#: ``ok`` on a refusal: the JSON boolean ``false``.
+OkFalse = Annotated[Literal[False], PlainValidator(_false)]
+
+
+def _origin(value: object) -> Origin:
+    return value if isinstance(value, Origin) else Origin.parse(value)
+
+
+#: An identity, written as ``https://<host>``.
+Identity = Annotated[Origin, PlainValidator(_origin), PlainSerializer(str, return_type=str)]
+
+
+def _authority(value: object) -> RequestAuthority:
+    return parse_authority(value)
+
+
+#: A request authority, written as ``host[:port]``.
+Authority = Annotated[
+    RequestAuthority, PlainValidator(_authority), PlainSerializer(str, return_type=str)
+]
+
+
+# ── messages ───────────────────────────────────────────────────────────────
+
+
+def _lines(value: object) -> HeaderLines:
+    """Field lines from JSON: an array of ``[name, value]`` string pairs, in wire order."""
+    if isinstance(value, HeaderLines):
+        return value
+    if not isinstance(value, (list, tuple)):
+        raise ValueError(f"headers are [name, value] pairs, not {value!r}")
+    pairs = [tuple(line) for line in value if isinstance(line, (list, tuple))]
+    if len(pairs) != len(value) or not all(
+        len(pair) == 2 and all(isinstance(part, str) for part in pair) for pair in pairs
+    ):
+        raise ValueError(f"headers are [name, value] pairs of strings, not {value!r}")
+    return HeaderLines((str(name), str(text)) for name, text in pairs)
+
+
+def _pairs(lines: HeaderLines) -> list[list[str]]:
+    return [[name, value] for name, value in lines]
+
+
+#: Field lines, written as ``[name, value]`` pairs in order, so a repeated field survives.
+Lines = Annotated[HeaderLines, PlainValidator(_lines), PlainSerializer(_pairs)]
+
+
+def _body(value: object) -> bytes:
+    """A body from JSON: a string of UTF-8 text, or ``{"base64": ...}`` for any other bytes."""
+    if isinstance(value, bytes):
+        return value
+    if isinstance(value, str):
+        return value.encode()
+    encoded = value.get("base64") if isinstance(value, dict) and len(value) == 1 else None
+    if not isinstance(encoded, str):
+        raise ValueError(f'a body is text or {{"base64": ...}}, not {value!r}')
+    return base64.b64decode(encoded, validate=True)
+
+
+def _body_json(body: bytes) -> str | dict[str, str]:
+    try:
+        return body.decode("utf-8")
+    except UnicodeDecodeError:
+        return {"base64": base64.b64encode(body).decode("ascii")}
+
+
+#: The exact body bytes: text when they are UTF-8, ``{"base64": ...}`` otherwise.
+Body = Annotated[bytes, PlainValidator(_body), PlainSerializer(_body_json)]
+_NO_LINES = HeaderLines()
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class RequestDoc(Model):
+    """A request: ``method``, absolute ``url``, field lines, and the exact body."""
+
+    method: str
+    url: str
+    headers: Lines = _NO_LINES
+    body: Body = b""
+
+    def message(self) -> HTTPRequest:
+        return HTTPRequest(self.method, self.url, self.headers, self.body)
+
+    @classmethod
+    def of(cls, request: HTTPRequest) -> RequestDoc:
+        return cls(
+            method=request.method, url=request.url, headers=request.headers, body=request.body
+        )
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class ResponseDoc(Model):
+    """A response: ``status``, field lines, and the exact body."""
+
+    status: int
+    headers: Lines = _NO_LINES
+    body: Body = b""
+
+    def message(self, request: HTTPRequest) -> HTTPResponse:
+        return HTTPResponse(self.status, self.headers, self.body, request)
+
+    @classmethod
+    def of(cls, response: HTTPResponse) -> ResponseDoc:
+        return cls(status=response.status, headers=response.headers, body=response.body)
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class DirectoryDoc(Model):
+    """A signed key directory response, and the ``url`` it is served at when known."""
+
+    url: str | None = None
+    status: int
+    headers: Lines = _NO_LINES
+    body: Body = b""
+
+    def fetched(self, url: str, now: UnixSeconds) -> DirectoryResponse:
+        return DirectoryResponse(url, self.status, self.headers, self.body, now)
+
+    def answer(self) -> Answer:
+        """The response as a directory server answers it."""
+        return Answer(self.status, self.headers, self.body)
+
+    @classmethod
+    def of(cls, url: str, answer: Answer) -> DirectoryDoc:
+        return cls(url=url, status=answer.status, headers=answer.headers, body=answer.body)
+
+
+# ── keys.json ──────────────────────────────────────────────────────────────
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class KeyEntry(Model):
+    """A published test key, with its private seed."""
+
+    identity: Identity
+    seed_name: str
+    kty: Literal["OKP"]
+    crv: Literal["Ed25519"]
+    kid: str
+    x: str
+    use: Literal["sig"]
+    private_d: Annotated[str, Field(alias="_private_d_for_test_only")]
+
+    def private_jwk(self) -> PrivateJwk:
+        return {"kty": self.kty, "crv": self.crv, "x": self.x, "d": self.private_d}
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class KeysDocument(Model):
+    comment: Annotated[str, Field(alias="$comment")]
+    keys: tuple[KeyEntry, ...]
+
+
+# ── refusals.json ──────────────────────────────────────────────────────────
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class RefusalEntry(Model):
+    rule: str
+    status: StatusCode
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class RefusalsDocument(Model):
+    """The refusal vocabulary, generated from :class:`Refusal`."""
+
+    comment: Annotated[str, Field(alias="$comment")]
+    refusals: tuple[RefusalEntry, ...]
+
+
+# ── outcomes ───────────────────────────────────────────────────────────────
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class AcceptSignature(Model):
+    """The ``Accept-Signature`` member a verifier SHOULD send with a ``403`` or ``429``."""
+
+    label: str
+    components: str
+    parameters: tuple[str, ...]
+    tag: str
+    nonce: str | None = None
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class Passes(Model):
+    """A verifier accepts, attributing the message to ``identity`` when one is named."""
+
+    ok: OkTrue = True
+    identity: Identity | None = None
+    rationale: str | None = None
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class Refuses(Model):
+    """A verifier refuses with ``rule``, and so with the rule's ``status``.
+
+    The status is the rule's when it is read and when :func:`refusing` makes one.
+    """
+
+    ok: OkFalse = False
+    rule: Rule
+    status: StatusCode
+    accept_signature: AcceptSignature | None = None
+    rationale: str | None = None
+
+    @model_validator(mode="after")
+    def _status_is_the_rules(self) -> Refuses:
+        if self.status != self.rule.status:
+            raise ValueError(f"status {self.status} is not the status of the rule {self.rule}")
+        return self
+
+
+def _outcome_tag(value: object) -> str | None:
+    ok = value.get("ok") if isinstance(value, Mapping) else getattr(value, "ok", None)
+    return "passes" if ok is True else "refuses" if ok is False else None
+
+
+#: What a verifier must answer: :class:`Passes` or :class:`Refuses`, on ``ok``.
+Outcome = Annotated[
+    Annotated[Passes, Tag("passes")] | Annotated[Refuses, Tag("refuses")],
+    Discriminator(_outcome_tag),
+]
+
+
+def passing(identity: Origin | str | None = None) -> Passes:
+    """A pass, attributed to ``identity`` when it is given."""
+    return Passes(identity=None if identity is None else _origin(identity))
+
+
+def refusing(
+    rule: Refusal, *, rationale: str | None = None, accept_signature: AcceptSignature | None = None
+) -> Refuses:
+    return Refuses(
+        rule=rule, status=rule.status, rationale=rationale, accept_signature=accept_signature
+    )
+
+
+# ── scenarios.json ─────────────────────────────────────────────────────────
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class NonceSpec(Model):
+    """Asks for ``bytes`` random bytes in ``encoding``."""
+
+    bytes: int
+    encoding: Literal["base64url", "base64", "base64url-padded"]
+
+
+class _Unset(enum.Enum):
+    UNSET = "unset"
+
+
+#: A parameter a scenario leaves as the profile signs it: absent from the JSON.
+UNSET: Final = _Unset.UNSET
+
+
+def _absent(value: object) -> _Unset:
+    raise ValueError("an absent parameter keeps the profile's value; there is no JSON for it")
+
+
+#: The type of :data:`UNSET`, which no JSON value validates as.
+Unset = Annotated[_Unset, PlainValidator(_absent)]
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class SignatureParameters(Model):
+    """A signature's parameters, as a scenario moves them from the profile's.
+
+    A parameter left out keeps the profile's value, and ``null`` leaves it
+    out of the signature. ``created`` and ``expires`` are offsets in seconds
+    from the harness clock; ``expires`` defaults to the signer's lifetime
+    after ``created``. ``nonce`` is a literal or a :class:`NonceSpec`. Any
+    other member is refused when the document is read.
+    """
+
+    created: int | Unset = UNSET
+    expires: int | None | Unset = UNSET
+    nonce: NonceSpec | str | None | Unset = UNSET
+    keyid: str | Unset = UNSET
+    alg: str | None | Unset = UNSET
+    tag: str | None | Unset = UNSET
+
+    def merged(self, later: SignatureParameters | None) -> SignatureParameters:
+        """These parameters with each one ``later`` sets."""
+        if later is None:
+            return self
+        changes = {f.name: getattr(later, f.name) for f in fields(later)}
+        return replace(self, **{name: v for name, v in changes.items() if v is not UNSET})
+
+    @model_serializer(mode="plain")
+    def _members(self) -> dict[str, object]:
+        """The parameters the scenario sets, ``null`` included; an unset one is absent."""
+        values = {f.name: getattr(self, f.name) for f in fields(self)}
+        return {
+            name: dump(value) if isinstance(value, NonceSpec) else value
+            for name, value in values.items()
+            if value is not UNSET
+        }
+
+
+#: The parameters of the profile itself, moved nowhere.
+PROFILE_PARAMETERS: Final = SignatureParameters()
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class ExtraSignature(Model):
+    label: str
+    kid: str
+    components: tuple[str, ...]
+    parameters: SignatureParameters = PROFILE_PARAMETERS
+
+
+def _appended(value: str, tail: str | None) -> str:
+    return value if tail is None else f"{value}, {tail}"
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class RequestEdits(Model):
+    """What a harness changes on a signed request: field values, appended members, the body."""
+
+    headers: dict[str, str] | None = None
+    append_members: dict[str, str] | None = None
+    append_to_body: str | None = None
+
+    def applied_to(self, request: HTTPRequest) -> HTTPRequest:
+        """``request`` with each field in ``headers`` replaced in place, each in
+        ``append_members`` longer, and ``append_to_body`` after its body."""
+        changed = {name.lower(): value for name, value in (self.headers or {}).items()}
+        extra = {name.lower(): value for name, value in (self.append_members or {}).items()}
+        lines = HeaderLines(
+            (name, _appended(changed.get(name.lower(), value), extra.get(name.lower())))
+            for name, value in request.headers
+        )
+        body = request.body + (self.append_to_body or "").encode()
+        return replace(request, headers=lines, body=body)
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class ResponseEdits(Model):
+    """What a harness changes on a signed response: its status, its body, and the request
+    it is shown with."""
+
+    status: int | None = None
+    append_to_body: str | None = None
+    request_headers: dict[str, str] | None = None
+
+    def applied_to(self, response: HTTPResponse) -> HTTPResponse:
+        request = response.request
+        for name, value in (self.request_headers or {}).items():
+            request = replace(request, headers=request.headers.with_replaced(name, value))
+        return HTTPResponse(
+            response.status if self.status is None else self.status,
+            response.headers,
+            response.body + (self.append_to_body or "").encode(),
+            request,
+        )
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class DirectoryEdits(Model):
+    """What a harness changes on a signed directory: its body."""
+
+    append_to_body: str | None = None
+
+    def applied_to(self, body: bytes) -> bytes:
+        return body + (self.append_to_body or "").encode()
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class Party(Model):
+    """Who signs: the identity, its ``kid``, and its ``Signature-Agent`` value."""
+
+    identity: Identity
+    kid: str
+    signature_agent: str
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class Scenario(Model):
+    id: str
+    name: str
+    tier: Tier = "wba"
+    basis: str
+    expected: Outcome
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class RequestScenario(Scenario):
+    """A request the harness signs at run time, and the outcome its verifier gives.
+
+    ``authority`` replaces the verifier's own authority.
+    """
+
+    base: Literal["post", "get"] = "post"
+    label: str = "sig1"
+    components: tuple[str, ...] | None = None
+    parameters: SignatureParameters | None = None
+    signature_agent: str | None = None
+    directories: dict[str, tuple[str, ...]] | None = None
+    extra_signature: ExtraSignature | None = None
+    after_signing: RequestEdits | None = None
+    authority: Authority | None = None
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class DirectoryScenario(Scenario):
+    """A directory the harness signs at run time, as the signer's own directory.
+
+    ``authority`` signs it for another authority. ``parameters`` moves
+    ``created`` and ``expires`` from the document's ``directory_parameters``.
+    """
+
+    keys: tuple[str, ...] | None = None
+    unsigned_keys: tuple[dict[str, str], ...] | None = None
+    authority: Authority | None = None
+    parameters: SignatureParameters | None = None
+    components: tuple[str, ...] | None = None
+    content_type: str | None = None
+    after_signing: DirectoryEdits | None = None
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class ResponseScenario(Scenario):
+    """A response the harness signs at run time, to the ``post`` request.
+
+    ``request`` is ``bound`` when the request is signed as the baseline, so the
+    response binds to it, and ``unbound`` when it is sent unsigned.
+    """
+
+    label: str = "sig1"
+    components: tuple[str, ...] | None = None
+    parameters: SignatureParameters | None = None
+    request: Literal["bound", "unbound"] = "bound"
+    after_signing: ResponseEdits | None = None
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class TargetUriCase(Model):
+    """A URL a ``GET`` is signed for, as a caller writes it, and its ``@target-uri``.
+
+    ``wire`` is the URL as it travels on the wire, the value every signature
+    base carries (``WEB_BOT_AUTH.md``, "The target URI"). Each side signs a
+    ``GET`` to ``url`` and the other verifies it as the signer's identity.
+    """
+
+    id: str
+    name: str
+    url: str
+    wire: str
+    basis: str
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class ScenariosDocument(Model):
+    """The failure scenarios, with every default both interpreters sign from.
+
+    ``parameters``, ``response_parameters``, and ``directory_parameters`` are
+    what a request, a response, and a directory signature carry unless a
+    scenario moves them; ``directory_max_age`` is the directory's
+    ``Cache-Control`` ``max-age``.
+    """
+
+    comment: Annotated[str, Field(alias="$comment")]
+    spec: str
+    spec_reference: str
+    signing_profile: Literal["web-bot-auth"] = "web-bot-auth"
+    signer: Party
+    responder: Party
+    verifier: Authority
+    requests: dict[Literal["post", "get"], RequestDoc]
+    components: dict[Literal["post", "get"], tuple[str, ...]]
+    parameters: SignatureParameters
+    response: ResponseDoc
+    response_components: dict[Literal["bound", "unbound"], tuple[str, ...]]
+    response_parameters: SignatureParameters
+    directory_parameters: SignatureParameters
+    directory_max_age: int
+    request_scenarios: tuple[RequestScenario, ...]
+    directory_scenarios: tuple[DirectoryScenario, ...]
+    response_scenarios: tuple[ResponseScenario, ...]
+    target_uris: tuple[TargetUriCase, ...]
+
+
+# ── operations and results (PROTOCOL.md) ───────────────────────────────────
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class SignRequest(Model):
+    op: Literal["sign_request"] = "sign_request"
+    key: PrivateJwk
+    origin: Identity
+    request: RequestDoc
+    now: UnixSeconds
+    label: str = "sig1"
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class SignDirectory(Model):
+    op: Literal["sign_directory"] = "sign_directory"
+    keys: tuple[PrivateJwk, ...]
+    origin: Identity
+    now: UnixSeconds
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class SignResponse(Model):
+    op: Literal["sign_response"] = "sign_response"
+    key: PrivateJwk
+    origin: Identity
+    request: RequestDoc
+    response: ResponseDoc
+    now: UnixSeconds
+    label: str = "sig1"
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class VerifyRequest(Model):
+    """Verify ``request`` as the verifier whose own authority is ``authority``.
+
+    ``prior`` lists requests verified first, with the same directories and
+    clock, so the verifier's replay state is built the way it would be.
+    """
+
+    op: Literal["verify_request"] = "verify_request"
+    request: RequestDoc
+    authority: Authority
+    directories: dict[str, DirectoryDoc] = field(default_factory=dict)
+    now: UnixSeconds
+    prior: tuple[RequestDoc, ...] = ()
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class VerifyDirectory(Model):
+    op: Literal["verify_directory"] = "verify_directory"
+    origin: Identity
+    response: DirectoryDoc
+    now: UnixSeconds
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class VerifyResponse(Model):
+    """Verify ``response`` to ``request``; from ``expected_origin`` when it is given."""
+
+    op: Literal["verify_response"] = "verify_response"
+    request: RequestDoc
+    response: ResponseDoc
+    directories: dict[str, DirectoryDoc] = field(default_factory=dict)
+    now: UnixSeconds
+    expected_origin: Identity | None = None
+
+
+Operation = Annotated[
+    SignRequest | SignDirectory | SignResponse | VerifyRequest | VerifyDirectory | VerifyResponse,
+    Field(discriminator="op"),
+]
+OPERATION: TypeAdapter[Operation] = TypeAdapter(Operation)
+
+#: The operation that grades a vector: one of the three verifications.
+VectorOperation = Annotated[
+    VerifyRequest | VerifyResponse | VerifyDirectory, Field(discriminator="op")
+]
+
+
+# ── vectors ────────────────────────────────────────────────────────────────
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class ReplayEntry(Model):
+    identity: Identity
+    nonce: str
+    ttl_seconds: int
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class Vector(Model):
+    """One committed operation and the outcome a verifier must give it.
+
+    ``operation`` is ready to send to an adapter as it is: the message, the
+    signed directories it names, the verifier's clock (``reference_now``),
+    and the authority or origin it is held to. ``replay_cache_entries`` is the
+    replay state its ``prior`` requests leave, for a white-box harness.
+    """
+
+    name: str
+    tier: Tier
+    spec: str
+    spec_reference: str
+    signing_profile: Literal["web-bot-auth"] = "web-bot-auth"
+    reference_now: UnixSeconds
+    operation: VectorOperation
+    replay_cache_entries: tuple[ReplayEntry, ...] = ()
+    expected_signature_base: dict[str, str] | None = None
+    expected: Outcome
+    comment: Annotated[str, Field(alias="$comment")]
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class ResultModel:
+    """A result an adapter returns, read strictly. Members the protocol doesn't name are
+    ignored."""
+
+    __pydantic_config__: ClassVar[ConfigDict] = ConfigDict(extra="ignore", strict=True)
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class Verified(ResultModel):
+    """A verified request or response: the identity it is attributed to and its key."""
+
+    ok: OkTrue = True
+    identity: str
+    keyid: str
+    body_covered: bool | None = None
+    bound: bool | None = None
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class KeysVerified(ResultModel):
+    """A verified directory: the ids of the keys it verified."""
+
+    ok: OkTrue = True
+    keyids: tuple[str, ...]
+
+
+#: The rules a harness gives a result that isn't the implementation's own answer.
+AdapterRule = Literal["adapter-error", "adapter-crash", "adapter-timeout", "adapter-invalid"]
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class Refused(ResultModel):
+    """A refusal, with its status and rule.
+
+    ``status`` is ``None`` only on a harness failure, whose ``rule`` is an
+    :data:`AdapterRule`; every expected refusal fails against it.
+    """
+
+    ok: OkFalse = False
+    status: StatusCode | None
+    rule: str
+    error: str = ""
+
+    @classmethod
+    def adapter_failure(cls, rule: AdapterRule, error: str) -> Refused:
+        return cls(status=None, rule=rule, error=error[:600])
+
+
+Result = Verified | KeysVerified | Refused | RequestDoc | ResponseDoc | DirectoryDoc
+
+
+def result_of(op: Operation, text: str) -> Result:
+    """Reads an adapter's JSON answer to ``op``: a refusal, or the operation's own result."""
+    data = json.loads(text)
+    if isinstance(data, Mapping) and data.get("ok") is False:
+        return read(Refused, text)
+    match op:
+        case SignRequest():
+            return read(RequestDoc, text)
+        case SignDirectory():
+            return read(DirectoryDoc, text)
+        case SignResponse():
+            return read(ResponseDoc, text)
+        case VerifyDirectory():
+            return read(KeysVerified, text)
+        case VerifyRequest() | VerifyResponse():
+            return read(Verified, text)
+
+
+__all__ = [
+    "OPERATION",
+    "PROFILE_PARAMETERS",
+    "UNSET",
+    "AcceptSignature",
+    "AdapterRule",
+    "Authority",
+    "Body",
+    "DirectoryDoc",
+    "DirectoryEdits",
+    "DirectoryScenario",
+    "ExtraSignature",
+    "Identity",
+    "KeyEntry",
+    "KeysDocument",
+    "KeysVerified",
+    "Lines",
+    "Model",
+    "NonceSpec",
+    "OkFalse",
+    "OkTrue",
+    "Operation",
+    "Outcome",
+    "Party",
+    "Passes",
+    "RefusalEntry",
+    "RefusalsDocument",
+    "Refused",
+    "Refuses",
+    "ReplayEntry",
+    "RequestDoc",
+    "RequestEdits",
+    "RequestScenario",
+    "ResponseDoc",
+    "ResponseEdits",
+    "ResponseScenario",
+    "Result",
+    "Rule",
+    "ScenariosDocument",
+    "SignDirectory",
+    "SignRequest",
+    "SignResponse",
+    "SignatureParameters",
+    "StatusCode",
+    "Suite",
+    "TargetUriCase",
+    "Tier",
+    "Unset",
+    "Vector",
+    "VectorOperation",
+    "Verified",
+    "VerifyDirectory",
+    "VerifyRequest",
+    "VerifyResponse",
+    "dump",
+    "dump_json",
+    "passing",
+    "read",
+    "refusing",
+    "result_of",
+]
diff --git a/src/iab_agentic_primitives/web_bot_auth/conformance/scenarios.py b/src/iab_agentic_primitives/web_bot_auth/conformance/scenarios.py
new file mode 100644
index 0000000..8bb0f8e
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/conformance/scenarios.py
@@ -0,0 +1,696 @@
+"""The failure scenarios of ``scenarios.json``, as data for a harness to sign at run time.
+
+Each scenario names its expected outcome; a refusal names its rule. A
+scenario states only what departs from the baseline: ``base`` defaults to
+``post`` and ``tier`` to ``wba``.
+"""
+
+from __future__ import annotations
+
+from ..directory import DEFAULT_PUBLISH
+from ..errors import Refusal
+from ..message import HeaderLines
+from ..rules import REQUEST, RESPONSE, SIGNATURE_TAG
+from ..values import DIRECTORY_PATH, Origin, RequestAuthority
+from .fixtures import (
+    BUYER,
+    BUYER_KEYS,
+    COMMIT_BODY,
+    COMMIT_RESULT_BODY,
+    COMMIT_URL,
+    DOC_URL,
+    OTHER_KEYS,
+    SELLER,
+    SELLER_AUTHORITY,
+    SELLER_KEYS,
+    SPEC,
+    TARGET_URIS,
+    key,
+    p256_public_jwk,
+)
+from .models import (
+    DirectoryEdits,
+    DirectoryScenario,
+    ExtraSignature,
+    NonceSpec,
+    Party,
+    RequestDoc,
+    RequestEdits,
+    RequestScenario,
+    ResponseDoc,
+    ResponseEdits,
+    ResponseScenario,
+    ScenariosDocument,
+    SignatureParameters,
+    TargetUriCase,
+    passing,
+    refusing,
+)
+from .signing import specs
+
+_BUYER = passing(BUYER)
+_SELLER = passing(SELLER)
+_DIRECTORY = passing()
+_no = refusing
+
+#: The profile's components, from the rules, with ``{label}`` and ``{request_label}``
+#: for the labels the harness signs with.
+_POST = specs(REQUEST.components("{label}", has_body=True))
+_GET = specs(REQUEST.components("{label}", has_body=False))
+_BOUND = specs(RESPONSE.components("{label}", has_body=True, request_label="{request_label}"))
+_UNBOUND = specs(RESPONSE.components("{label}", has_body=True))
+#: The post components without the Signature-Agent member, for the scenarios that change it.
+_POST_BODY = _POST[:-1]
+_VALUE_RULE = (
+    f"Profile: the value is exactly https://<host>{DIRECTORY_PATH} or https://<host>, "
+    "compared without normalizing"
+)
+_NO_PARAMETERS = (
+    "WBA -01 section 5.2.1: members MUST NOT carry parameters, and a verifier MUST ignore "
+    "one that does"
+)
+
+
+def _value_scenario(
+    sid: str, name: str, value: str, basis: str, directories: tuple[str, ...] = ()
+) -> RequestScenario:
+    """A ``Signature-Agent`` value the profile refuses."""
+    return RequestScenario(
+        id=sid,
+        name=name,
+        signature_agent=f'sig1="{value}"',
+        directories={directories[0]: (str(key("buyer-request").thumbprint),)}
+        if directories
+        else None,
+        expected=_no(Refusal.SIGNATURE_AGENT_VALUE),
+        tier="profile",
+        basis=f"{_VALUE_RULE}; {basis}",
+    )
+
+
+def _value_scenarios() -> tuple[RequestScenario, ...]:
+    port = f"{BUYER}:8443"
+    return (
+        _value_scenario(
+            "R17",
+            "Path other than the well-known path",
+            f"{BUYER}/jwks.json",
+            "the library does not check it",
+        ),
+        _value_scenario(
+            "R17a", "Well-known path with a trailing /", f"{BUYER_KEYS}/", "no trailing /"
+        ),
+        _value_scenario(
+            "R17b",
+            "Well-known path in another case",
+            f"{BUYER}/.well-known/HTTP-Message-Signatures-Directory",
+            "the path is compared as a string",
+        ),
+        _value_scenario("R17c", "Origin with a trailing /", f"{BUYER}/", "no trailing /"),
+        _value_scenario(
+            "R17d",
+            "Uppercase host",
+            f"https://BUYER.example.com{DIRECTORY_PATH}",
+            "a lowercase host",
+        ),
+        _value_scenario("R17e", "Explicit :443", f"{BUYER}:443{DIRECTORY_PATH}", "no port"),
+        _value_scenario("R17f", "Other port", f"{port}{DIRECTORY_PATH}", "no port", (port,)),
+        _value_scenario("R17g", "Query", f"{BUYER_KEYS}?v=1", "no query"),
+        _value_scenario("R17h", "Fragment", f"{BUYER_KEYS}#k", "no fragment"),
+        _value_scenario(
+            "R17i", "Userinfo", f"https://agent@buyer.example.com{DIRECTORY_PATH}", "no userinfo"
+        ),
+        _value_scenario("R17j", "Origin with a query", f"{BUYER}?v=1", "no query"),
+    )
+
+
+def _window_and_nonce_scenarios() -> tuple[RequestScenario, ...]:
+    return (
+        RequestScenario(
+            id="R03",
+            name="Expired",
+            parameters=SignatureParameters(created=-400, expires=-100),
+            expected=_no(Refusal.EXPIRED),
+            basis="RFC 9421 section 3.2.1",
+        ),
+        RequestScenario(
+            id="R04",
+            name="created 120 seconds in the future",
+            parameters=SignatureParameters(created=120, expires=400),
+            expected=_no(Refusal.CREATED_IN_FUTURE),
+            basis="Profile: 60 seconds of clock skew",
+        ),
+        RequestScenario(
+            id="R05",
+            name="created 30 seconds in the future",
+            parameters=SignatureParameters(created=30, expires=300),
+            expected=_BUYER,
+            tier="profile",
+            basis="Profile: 60 seconds of clock skew; the library allows none by default",
+        ),
+        RequestScenario(
+            id="R06",
+            name="Lifetime of 3600 seconds",
+            parameters=SignatureParameters(created=-5, expires=3595),
+            expected=_no(Refusal.LIFETIME),
+            tier="profile",
+            basis="Profile: expires at most 300 seconds after created",
+        ),
+        RequestScenario(
+            id="R07",
+            name="Nonce of 32 bytes",
+            parameters=SignatureParameters(nonce=NonceSpec(bytes=32, encoding="base64url")),
+            expected=_no(Refusal.NONCE_INVALID),
+            basis="Profile: 64-byte nonce; validateNonce",
+        ),
+        RequestScenario(
+            id="R08",
+            name="Nonce in canonical padded base64",
+            parameters=SignatureParameters(nonce=NonceSpec(bytes=64, encoding="base64")),
+            expected=_BUYER,
+            basis="Profile: unpadded base64url or canonical padded base64",
+        ),
+        RequestScenario(
+            id="R09",
+            name="Nonce in padded base64url",
+            parameters=SignatureParameters(nonce=NonceSpec(bytes=64, encoding="base64url-padded")),
+            expected=_no(Refusal.NONCE_INVALID),
+            basis="Profile: unpadded base64url or canonical padded base64",
+        ),
+        RequestScenario(
+            id="R10",
+            name="No alg parameter",
+            parameters=SignatureParameters(alg=None),
+            expected=_no(Refusal.ALG),
+            basis="Profile: alg required",
+        ),
+        RequestScenario(
+            id="R11",
+            name="alg other than ed25519",
+            parameters=SignatureParameters(alg="ecdsa-p256-sha256"),
+            expected=_no(Refusal.ALG),
+            basis="Profile: alg is ed25519 and matches the key; RFC 9421 section 3.2",
+        ),
+    )
+
+
+def _component_scenarios() -> tuple[RequestScenario, ...]:
+    return (
+        RequestScenario(
+            id="R12",
+            name="GET covering only @authority and the Signature-Agent member",
+            base="get",
+            components=("@authority", "signature-agent;key=sig1"),
+            expected=_no(Refusal.COMPONENTS),
+            tier="profile",
+            basis=(
+                "Profile: cover @method, @target-uri, and @authority; WBA section 5.2 needs one "
+                "of @authority or @target-uri"
+            ),
+        ),
+        RequestScenario(
+            id="R13",
+            name="Body without content-digest covered",
+            components=(
+                "@method",
+                "@target-uri",
+                "@authority",
+                "content-type",
+                "signature-agent;key=sig1",
+            ),
+            expected=_no(Refusal.COMPONENTS),
+            tier="profile",
+            basis=(
+                "Profile: a request with a body covers content-type and content-digest; WBA "
+                "section 5.2"
+            ),
+        ),
+        RequestScenario(
+            id="R13b",
+            name="Body without content-type covered",
+            components=(
+                "@method",
+                "@target-uri",
+                "@authority",
+                "content-digest",
+                "signature-agent;key=sig1",
+            ),
+            expected=_no(Refusal.COMPONENTS),
+            tier="profile",
+            basis="Profile: a request with a body covers content-type and content-digest",
+        ),
+        RequestScenario(
+            id="R14",
+            name="tag other than web-bot-auth",
+            parameters=SignatureParameters(tag="other-profile/v1"),
+            expected=_no(Refusal.SIGNATURE_MISSING),
+            basis="WBA section 5.2: tag MUST be web-bot-auth",
+        ),
+        RequestScenario(
+            id="R23",
+            name="Components in another order",
+            components=(
+                "signature-agent;key=sig1",
+                "@authority",
+                "content-digest",
+                "@target-uri",
+                "content-type",
+                "@method",
+            ),
+            expected=_BUYER,
+            basis="RFC 9421: the order is the signer's",
+        ),
+        RequestScenario(
+            id="R24",
+            name="No nonce",
+            parameters=SignatureParameters(nonce=None),
+            expected=_no(Refusal.NONCE_MISSING),
+            tier="profile",
+            basis="Profile: a nonce on every signed request; WBA leaves it to deployment policy",
+        ),
+        RequestScenario(
+            id="R25",
+            name="GET with the profile's components",
+            base="get",
+            expected=_BUYER,
+            basis="Profile rules; a request without a body covers no content-digest",
+        ),
+    )
+
+
+def _agent_scenarios() -> tuple[RequestScenario, ...]:
+    http: dict[str, tuple[str, ...]] = {
+        "http://buyer.example.com": (str(key("buyer-request").thumbprint),)
+    }
+    return (
+        RequestScenario(
+            id="R15",
+            name="Bare-string Signature-Agent",
+            signature_agent=f'"{BUYER_KEYS}"',
+            components=(*_POST_BODY, "signature-agent"),
+            expected=_no(Refusal.PARSE),
+            tier="profile",
+            basis=(
+                "Profile: dictionary form only, so the field does not parse; WBA section 5.2.1 "
+                "lets a verifier accept the bare string"
+            ),
+        ),
+        RequestScenario(
+            id="R16",
+            name="http:// key URL",
+            signature_agent=f'sig1="http://buyer.example.com{DIRECTORY_PATH}"',
+            directories=http,
+            expected=_no(Refusal.SIGNATURE_AGENT_VALUE),
+            tier="profile",
+            basis=(
+                "WBA section 5.2.1: the scheme MUST be https; the library accepts http "
+                "(cloudflare/web-bot-auth#162)"
+            ),
+        ),
+        RequestScenario(
+            id="R16b",
+            name="http:// origin",
+            signature_agent='sig1="http://buyer.example.com"',
+            directories=http,
+            expected=_no(Refusal.SIGNATURE_AGENT_VALUE),
+            tier="profile",
+            basis="WBA section 5.2.1: the scheme MUST be https",
+        ),
+        *_value_scenarios(),
+        RequestScenario(
+            id="R18",
+            name="Member with type=jwks_uri",
+            signature_agent=f'sig1="{BUYER}/jwks.json";type=jwks_uri',
+            expected=_no(Refusal.SIGNATURE_AGENT_PARAMETERS),
+            tier="profile",
+            basis="WBA -01 section 5.2.1: a verifier MUST ignore a member that carries parameters",
+        ),
+        RequestScenario(
+            id="R18c",
+            name="Origin member with type=directory as a Token",
+            signature_agent=f'sig1="{BUYER}";type=directory',
+            expected=_no(Refusal.SIGNATURE_AGENT_PARAMETERS),
+            tier="profile",
+            basis=_NO_PARAMETERS,
+        ),
+        RequestScenario(
+            id="R18d",
+            name='Key URL member with type="directory" as a String',
+            signature_agent=f'sig1="{BUYER_KEYS}";type="directory"',
+            expected=_no(Refusal.SIGNATURE_AGENT_PARAMETERS),
+            tier="profile",
+            basis=_NO_PARAMETERS,
+        ),
+        RequestScenario(
+            id="R18e",
+            name="Bare origin, the draft -00 form",
+            signature_agent=f'sig1="{BUYER}"',
+            expected=_BUYER,
+            basis=(
+                "WBA -00 section 5.5: a directory member is an origin; the verifier fetches the "
+                "same well-known URL"
+            ),
+        ),
+        RequestScenario(
+            id="R19",
+            name="Signature-Agent member keyed differently from the label",
+            signature_agent=f'agent1="{BUYER_KEYS}"',
+            components=(*_POST_BODY, "signature-agent;key=agent1"),
+            expected=_no(Refusal.SIGNATURE_AGENT_MISSING),
+            tier="profile",
+            basis=(
+                "WBA section 5.2.1: the member keyed to the label; the library does not check it"
+            ),
+        ),
+        RequestScenario(
+            id="R21",
+            name="Two Signature-Agent members, one signature",
+            signature_agent=f'sig1="{BUYER_KEYS}", sig2="{OTHER_KEYS}"',
+            expected=_no(Refusal.MULTIPLE_SIGNATURE_AGENTS),
+            tier="profile",
+            basis="Profile: exactly one Signature-Agent member",
+        ),
+        RequestScenario(
+            id="R22",
+            name="Label other than sig1",
+            label="wba",
+            expected=_BUYER,
+            basis="RFC 9421: the signer chooses the label",
+        ),
+    )
+
+
+def _request_scenarios() -> tuple[RequestScenario, ...]:
+    cdn = ExtraSignature(
+        label="cdn",
+        kid=key("other-request").thumbprint,
+        components=("@method", "@authority"),
+        parameters=SignatureParameters(created=-5, expires=295, nonce=None, tag="cdn-edge"),
+    )
+    return (
+        RequestScenario(id="R00", name="Baseline", expected=_BUYER, basis="Profile rules"),
+        RequestScenario(
+            id="R01",
+            name="Body changed after signing",
+            after_signing=RequestEdits(append_to_body="\n"),
+            expected=_no(Refusal.CONTENT_DIGEST),
+            tier="profile",
+            basis="Content-Digest matches the body: RFC 9530; WBA section 5.2",
+        ),
+        RequestScenario(
+            id="R02",
+            name="Covered header changed after signing",
+            after_signing=RequestEdits(headers={"content-type": "text/plain"}),
+            expected=_no(Refusal.SIGNATURE_INVALID),
+            basis="RFC 9421 section 3.2",
+        ),
+        *_window_and_nonce_scenarios(),
+        *_component_scenarios(),
+        *_agent_scenarios(),
+        RequestScenario(
+            id="R20",
+            name="Second signature with tag cdn-edge",
+            extra_signature=cdn,
+            expected=_BUYER,
+            tier="profile",
+            basis=(
+                "Profile: Signature-Input members with other tags are not read; the library "
+                "requires a label when a request carries two signatures"
+            ),
+        ),
+        RequestScenario(
+            id="R20b",
+            name="Second member with tag cdn-edge whose Signature value is a token",
+            after_signing=RequestEdits(
+                append_members={
+                    "signature-input": 'cdn=("@method" "@authority");tag="cdn-edge"',
+                    "signature": "cdn=edge-token",
+                }
+            ),
+            expected=_no(Refusal.PARSE),
+            basis=(
+                "RFC 9421 section 4.2: every Signature member value is a Byte Sequence, so the "
+                "field is malformed whatever the member's tag"
+            ),
+        ),
+        RequestScenario(
+            id="R26",
+            name="Signed for seller.example.com, verified by seller-b.example.com",
+            authority=RequestAuthority("seller-b.example.com"),
+            expected=_no(Refusal.AUTHORITY),
+            tier="profile",
+            basis=(
+                "OpenProposal § 2.8.4 step 5: the signed @authority is the verifier's own "
+                "configured authority, never the Host it was sent"
+            ),
+        ),
+    )
+
+
+def _directory_scenarios() -> tuple[DirectoryScenario, ...]:
+    window = Refusal.DIRECTORY_WINDOW
+    return (
+        DirectoryScenario(id="D00", name="Baseline", expected=_DIRECTORY, basis="WBA Appendix B.1"),
+        DirectoryScenario(
+            id="D01",
+            name="Signed for another authority",
+            authority=RequestAuthority("other.example.com"),
+            expected=_no(Refusal.DIRECTORY_SIGNATURE),
+            basis='WBA Appendix B.1: covers "@authority";req',
+        ),
+        DirectoryScenario(
+            id="D02",
+            name="Body changed after signing",
+            after_signing=DirectoryEdits(append_to_body="\n"),
+            expected=_no(Refusal.DIRECTORY_CONTENT_DIGEST),
+            tier="profile",
+            basis=(
+                "WBA Appendix B.1: the verifier MUST validate Content-Digest; the library does "
+                "not compare it with the body"
+            ),
+        ),
+        DirectoryScenario(
+            id="D03",
+            name="Unsigned",
+            keys=(),
+            unsigned_keys=({k: str(v) for k, v in key("buyer-request").public_jwk().items()},),
+            expected=_no(Refusal.DIRECTORY_ONE_SIGNATURE_PER_KEY),
+            basis="Profile: every Ed25519 key signs (Appendix B.1 recommends it)",
+        ),
+        DirectoryScenario(
+            id="D04",
+            name="Signature created in the future",
+            parameters=SignatureParameters(created=3600, expires=90000),
+            expected=_no(window),
+            basis=(
+                "WBA Appendix B.1: reject a future created; the profile allows the same 60 s "
+                "skew as for requests"
+            ),
+        ),
+        DirectoryScenario(
+            id="D05",
+            name='Covers "@authority";req only',
+            components=("@authority;req",),
+            expected=_no(Refusal.DIRECTORY_COMPONENTS),
+            tier="profile",
+            basis="WBA Appendix B.1: covers content-digest",
+        ),
+        DirectoryScenario(
+            id="D06",
+            name="Expired signature",
+            parameters=SignatureParameters(created=-7200, expires=-3600),
+            expected=_no(window),
+            basis="RFC 9421 section 3.2.1",
+        ),
+        DirectoryScenario(
+            id="D07",
+            name="Extra P-256 key that does not sign",
+            unsigned_keys=(p256_public_jwk(),),
+            expected=_DIRECTORY,
+            basis="Profile: ignore keys the profile does not use (RFC 7517 section 5)",
+        ),
+        DirectoryScenario(
+            id="D08",
+            name="Media type application/json",
+            content_type="application/json",
+            expected=_no(Refusal.DIRECTORY_MEDIA_TYPE),
+            tier="profile",
+            basis=(
+                "WBA section 5.5.1: the well-known directory MUST be served with "
+                "application/http-message-signatures-directory+json"
+            ),
+        ),
+        DirectoryScenario(
+            id="D09",
+            name="Signature expired one second ago",
+            parameters=SignatureParameters(created=-600, expires=-1),
+            expected=_no(window),
+            basis=(
+                "Profile: the clock skew applies to created only; a directory verifies until its "
+                "expires"
+            ),
+        ),
+        DirectoryScenario(
+            id="D10",
+            name="Signature that expires now",
+            parameters=SignatureParameters(created=-600, expires=0),
+            expected=_DIRECTORY,
+            basis="Profile: a directory verifies until its expires, that second included",
+        ),
+    )
+
+
+def _response_scenarios() -> tuple[ResponseScenario, ...]:
+    return (
+        ResponseScenario(
+            id="P00",
+            name="Baseline, bound to the signed request",
+            expected=_SELLER,
+            basis="OpenProposal 3.0 § 2.8: response components; RFC 9421 section 2.4",
+        ),
+        ResponseScenario(
+            id="P01",
+            name="Body changed after signing",
+            after_signing=ResponseEdits(append_to_body="\n"),
+            expected=_no(Refusal.CONTENT_DIGEST),
+            tier="profile",
+            basis="Content-Digest matches the body: RFC 9530",
+        ),
+        ResponseScenario(
+            id="P02",
+            name="Status changed after signing",
+            after_signing=ResponseEdits(status=201),
+            expected=_no(Refusal.SIGNATURE_INVALID),
+            basis="RFC 9421 section 2.2.9: @status is covered",
+        ),
+        ResponseScenario(
+            id="P03",
+            name="Signed request, response not bound to it",
+            components=_UNBOUND,
+            expected=_no(Refusal.RESPONSE_NOT_BOUND),
+            tier="profile",
+            basis=(
+                'Profile: a response to a signed request covers "signature";req;key=<request label>'
+            ),
+        ),
+        ResponseScenario(
+            id="P04",
+            name="Bound to another request",
+            after_signing=ResponseEdits(request_headers={"Signature": "sig1=:" + "A" * 86 + "==:"}),
+            expected=_no(Refusal.SIGNATURE_INVALID),
+            basis="RFC 9421 section 2.4: the request's signature is covered",
+        ),
+        ResponseScenario(
+            id="P05",
+            name="@status not covered",
+            components=_BOUND[1:],
+            expected=_no(Refusal.COMPONENTS),
+            tier="profile",
+            basis="Profile: response components",
+        ),
+        ResponseScenario(
+            id="P06",
+            name="Lifetime of 3600 seconds",
+            parameters=SignatureParameters(created=-5, expires=3595),
+            expected=_no(Refusal.LIFETIME),
+            tier="profile",
+            basis="Profile: expires at most 300 seconds after created",
+        ),
+        ResponseScenario(
+            id="P07",
+            name="Unsigned request, response without a binding",
+            request="unbound",
+            expected=_SELLER,
+            basis="Profile: the binding applies when the request carried a signature",
+        ),
+        ResponseScenario(
+            id="P08",
+            name="Response signed with tag other than web-bot-auth",
+            parameters=SignatureParameters(tag="other-profile/v1"),
+            expected=_no(Refusal.SIGNATURE_MISSING),
+            tier="profile",
+            basis="Profile: tag web-bot-auth",
+        ),
+    )
+
+
+def _target_uris() -> tuple[TargetUriCase, ...]:
+    return tuple(
+        TargetUriCase(
+            id=f"U{i:02}",
+            name=t.name,
+            url=t.url,
+            wire=t.wire,
+            basis="Profile: @target-uri is the URL as it travels on the wire (RFC 3986 § 6.2.2)",
+        )
+        for i, t in enumerate(TARGET_URIS, 1)
+    )
+
+
+_COMMENT = (
+    "Failure scenarios for the Web Bot Auth profile, as data. A harness signs each request, "
+    "directory, and response scenario at run time, applies after_signing, and grades the "
+    "verifier on expected: a pass, or a refusal by its status and rule (refusals.json). "
+    "created and expires are offsets in seconds from the harness clock; a null parameter is "
+    "omitted; a nonce object asks for that many random bytes in that encoding. verifier is the "
+    "verifier's own authority, which a request scenario's authority replaces. tier \"wba\": the "
+    "reference libraries with no profile rules already give the expected outcome. tier "
+    '"profile": the bare libraries give the opposite outcome and only the profile\'s rules give '
+    'the expected one; a WBA MUST the library does not enforce stays "profile" until it does. '
+    "Each target_uris case is a GET to url, which each side signs and the other verifies; wire "
+    "is its @target-uri. See README.md."
+)
+
+
+def build_scenarios() -> ScenariosDocument:
+    buyer, seller = key("buyer-request"), key("seller-response")
+    return ScenariosDocument(
+        comment=_COMMENT,
+        spec=SPEC,
+        spec_reference=f"{DOC_URL}#profile-rules",
+        signer=Party(
+            identity=Origin.parse(BUYER), kid=buyer.thumbprint, signature_agent=BUYER_KEYS
+        ),
+        responder=Party(
+            identity=Origin.parse(SELLER), kid=seller.thumbprint, signature_agent=SELLER_KEYS
+        ),
+        verifier=RequestAuthority(SELLER_AUTHORITY),
+        requests={
+            "post": RequestDoc(
+                method="POST",
+                url=COMMIT_URL,
+                headers=HeaderLines([("content-type", "application/json")]),
+                body=COMMIT_BODY,
+            ),
+            "get": RequestDoc(method="GET", url=f"{SELLER}/proposals/prop_7?view=a%7Eb&x=1"),
+        },
+        components={
+            "post": _POST,
+            "get": _GET,
+        },
+        parameters=SignatureParameters(
+            created=-5,
+            expires=295,
+            nonce=NonceSpec(bytes=64, encoding="base64url"),
+            tag=SIGNATURE_TAG,
+        ),
+        response=ResponseDoc(
+            status=200,
+            headers=HeaderLines([("content-type", "application/json")]),
+            body=COMMIT_RESULT_BODY,
+        ),
+        response_components={
+            "bound": _BOUND,
+            "unbound": _UNBOUND,
+        },
+        response_parameters=SignatureParameters(created=-5, expires=295, tag=SIGNATURE_TAG),
+        directory_parameters=SignatureParameters(created=0, expires=DEFAULT_PUBLISH.lifetime),
+        directory_max_age=DEFAULT_PUBLISH.max_age,
+        request_scenarios=_request_scenarios(),
+        directory_scenarios=_directory_scenarios(),
+        response_scenarios=_response_scenarios(),
+        target_uris=_target_uris(),
+    )
+
+
+__all__ = ["build_scenarios"]
diff --git a/src/iab_agentic_primitives/web_bot_auth/conformance/signing.py b/src/iab_agentic_primitives/web_bot_auth/conformance/signing.py
new file mode 100644
index 0000000..0e6f554
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/conformance/signing.py
@@ -0,0 +1,440 @@
+"""The scenario interpreter: signs what ``scenarios.json`` describes.
+
+A profile message is signed by :class:`RequestSigner` or :class:`ResponseSigner`,
+and a profile directory by :func:`publish_directory`. A scenario can carry
+what the profile refuses (another ``alg``, a missing nonce, an uncovered
+member, a directory signed for another authority). Those are signed raw:
+:class:`RawSigner` signs a request or a response as a :class:`SignerConfig`
+would, departing as a :class:`MessageDeparture` says, and
+:func:`sign_directory_body` signs a directory as a :class:`DirectoryDeparture`
+says. Both go through the private raw signer, which only this package may
+import. A scenario's ``after_signing`` edits are applied to the signed
+message by the edits' own ``applied_to``, which signs nothing.
+"""
+
+from __future__ import annotations
+
+import base64
+import secrets
+from collections.abc import Callable, Mapping, Sequence
+from dataclasses import dataclass, replace
+from typing import Literal, TypeVar
+from urllib.parse import urlsplit
+
+from .._unchecked import SignatureParams, content_digest, sign_each_unchecked, sign_unchecked
+from ..directory import DEFAULT_PUBLISH, build_directory, publish_directory
+from ..errors import ConfigurationError
+from ..keys import Ed25519Key
+from ..message import HeaderLines, HTTPRequest, HTTPResponse
+from ..rules import (
+    ALGORITHM,
+    DIRECTORY,
+    REQUEST,
+    RESPONSE,
+    ComponentId,
+    Rules,
+    Stamp,
+    component_id,
+)
+from ..signer import SignerConfig
+from ..values import (
+    DIRECTORY_MEDIA_TYPE,
+    DIRECTORY_PATH,
+    OMIT,
+    KeyId,
+    Omit,
+    Origin,
+    UnixSeconds,
+    b64url_encode,
+)
+from .models import (
+    UNSET,
+    DirectoryDoc,
+    DirectoryScenario,
+    NonceSpec,
+    RequestDoc,
+    RequestScenario,
+    ResponseDoc,
+    ResponseScenario,
+    ScenariosDocument,
+    SignatureParameters,
+    Unset,
+    passing,
+)
+
+M = TypeVar("M", HTTPRequest, HTTPResponse)
+N = TypeVar("N", str, str | None)
+
+#: Returns ``n`` random bytes; the vector generator passes a deterministic source.
+RandomBytes = Callable[[int], bytes]
+
+
+def parse_component_spec(spec: str) -> ComponentId:
+    """A component as ``scenarios.json`` spells it.
+
+    ``"signature-agent;key=sig1"`` is ``"signature-agent";key="sig1"``, and
+    ``"@authority;req"`` is ``"@authority";req``.
+    """
+    name, *params = spec.split(";")
+    parsed: dict[str, str | bool] = {}
+    for param in params:
+        key, has_value, value = param.partition("=")
+        parsed[key] = value if has_value else True
+    return component_id(name, parsed)
+
+
+def component_spec(component: ComponentId) -> str:
+    """``component`` as ``scenarios.json`` spells it, such as ``signature-agent;key=sig1``.
+
+    It is the inverse of :func:`parse_component_spec`.
+    """
+    params = "".join(f";{k}" if v is True else f";{k}={v}" for k, v in component.params)
+    return component.name + params
+
+
+def specs(components: Sequence[ComponentId]) -> tuple[str, ...]:
+    """``components`` as ``scenarios.json`` spells them."""
+    return tuple(component_spec(c) for c in components)
+
+
+def components_of(
+    specs: Sequence[str], label: str, request_label: str = "sig1"
+) -> tuple[ComponentId, ...]:
+    """The components ``specs`` name, with ``{label}`` and ``{request_label}`` filled in."""
+    filled = (s.replace("{label}", label).replace("{request_label}", request_label) for s in specs)
+    return tuple(parse_component_spec(s) for s in filled)
+
+
+_NONCE_ENCODINGS: dict[str, Callable[[bytes], str]] = {
+    "base64url": b64url_encode,
+    "base64": lambda b: base64.b64encode(b).decode(),
+    "base64url-padded": lambda b: base64.urlsafe_b64encode(b).decode(),
+}
+
+
+def nonce_value(spec: NonceSpec, random_bytes: RandomBytes = secrets.token_bytes) -> str:
+    """A nonce of ``spec.bytes`` random bytes in ``spec.encoding``."""
+    for _ in range(1000):
+        value = _NONCE_ENCODINGS[spec.encoding](random_bytes(spec.bytes))
+        # Padded base64url with no '-' or '_' is also canonical padded base64, which the
+        # profile accepts.
+        if spec.encoding != "base64url-padded" or "-" in value or "_" in value:
+            return value
+    raise RuntimeError("no base64url-padded nonce with '-' or '_'")  # pragma: no cover
+
+
+#: The nonce a request signature carries when a scenario names none.
+PROFILE_NONCE = NonceSpec(bytes=64, encoding="base64url")
+
+
+def _text_parameter(value: str | None | Unset, profile: str) -> str | Omit:
+    """A text parameter: the profile's when unset, left out when ``null``."""
+    if value is UNSET:
+        return profile
+    return OMIT if value is None else value
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class MessageDeparture:
+    """What a raw request or response signs differently from the profile.
+
+    ``components`` replaces the covered components, and ``parameters`` moves
+    the parameters (:class:`~.models.SignatureParameters`). ``signature_agent``
+    is the ``Signature-Agent`` value to add (``OMIT`` adds none), and
+    ``content_digest`` the ``Content-Digest`` to add, unchecked.
+    ``keep_signatures`` signs beside the signatures already on the message.
+    """
+
+    components: tuple[ComponentId, ...] | None = None
+    parameters: SignatureParameters = SignatureParameters()
+    signature_agent: str | Omit | None = None
+    content_digest: str | None = None
+    keep_signatures: bool = False
+
+
+#: The profile's own message signing, departing from nothing.
+PROFILE_MESSAGE = MessageDeparture()
+
+
+@dataclass(frozen=True, slots=True)
+class RawSigner:
+    """Signs requests and responses as ``config`` would, departing as ``departure`` says.
+
+    With :data:`PROFILE_MESSAGE` it signs what the profile's signers sign.
+    ``random_bytes`` is the nonce source; the vector generator passes a
+    deterministic one.
+    """
+
+    config: SignerConfig
+    departure: MessageDeparture = PROFILE_MESSAGE
+    random_bytes: RandomBytes = secrets.token_bytes
+
+    def request(self, request: HTTPRequest, now: UnixSeconds) -> HTTPRequest:
+        """``request`` signed at ``now``."""
+        return self._signed(request, REQUEST, now)
+
+    def response(self, response: HTTPResponse, now: UnixSeconds) -> HTTPResponse:
+        """``response`` signed at ``now``, bound to its request as the departure allows."""
+        return self._signed(response, RESPONSE, now)
+
+    def _signed(self, message: M, rules: Rules[M, N], now: UnixSeconds) -> M:
+        prepared = replace(message, headers=self._covered_lines(message))
+        mode: Literal["append", "replace"] = (
+            "append" if self.departure.keep_signatures else "replace"
+        )
+        params = self._params(prepared, rules, now)
+        return sign_unchecked(prepared, self.config.key, params, mode=mode)
+
+    def _covered_lines(self, message: HTTPRequest | HTTPResponse) -> HeaderLines:
+        """The message's lines with the ``Content-Digest`` and ``Signature-Agent`` it signs."""
+        lines, departure = message.headers, self.departure
+        if message.body and "content-digest" not in lines:
+            lines = lines.with_added(
+                "Content-Digest", departure.content_digest or content_digest(message.body)
+            )
+        agent = departure.signature_agent
+        if agent is None:
+            agent = f'{self.config.label}="{self.config.origin.directory_url}"'
+        return lines if agent is OMIT else lines.with_added("Signature-Agent", agent)
+
+    def _nonce(self, rules: Rules[M, N]) -> str | Omit:
+        value = self.departure.parameters.nonce
+        if value is UNSET:
+            value = PROFILE_NONCE if rules.nonce_required else None
+        if isinstance(value, NonceSpec):
+            return nonce_value(value, self.random_bytes)
+        return OMIT if value is None else value
+
+    def _params(self, message: M, rules: Rules[M, N], now: UnixSeconds) -> SignatureParams:
+        p, config = self.departure.parameters, self.config
+        created = UnixSeconds(now + (0 if p.created is UNSET else p.created))
+        expires: UnixSeconds | Omit = UnixSeconds(created + config.lifetime)
+        if p.expires is not UNSET:
+            expires = OMIT if p.expires is None else UnixSeconds(now + p.expires)
+        components = self.departure.components or rules.components_for(message, config.label)
+        return SignatureParams(
+            label=config.label,
+            components=components,
+            created=created,
+            keyid=config.key.thumbprint if p.keyid is UNSET else KeyId(p.keyid),
+            expires=expires,
+            nonce=self._nonce(rules),
+            tag=_text_parameter(p.tag, rules.tag),
+            alg=_text_parameter(p.alg, ALGORITHM),
+        )
+
+
+def _offset(value: int | None | Unset, default: int) -> int:
+    """An offset in seconds; the default when it is unset or ``null``."""
+    return default if value is UNSET or value is None else value
+
+
+# ── requests ───────────────────────────────────────────────────────────────
+
+
+def _config(key: Ed25519Key, origin: Origin, label: str) -> SignerConfig:
+    return SignerConfig(key, origin, label=label)
+
+
+def sign_request_scenario(
+    doc: ScenariosDocument,
+    scenario: RequestScenario,
+    keys: Mapping[str, Ed25519Key],
+    now: UnixSeconds,
+    random_bytes: RandomBytes = secrets.token_bytes,
+) -> HTTPRequest:
+    """Signs one request scenario at ``now`` and returns the request as the verifier sees it."""
+    label = scenario.label
+    departure = MessageDeparture(
+        components=components_of(scenario.components or doc.components[scenario.base], label),
+        parameters=doc.parameters.merged(scenario.parameters),
+        signature_agent=scenario.signature_agent,
+    )
+    config = _config(keys[doc.signer.kid], doc.signer.identity, label)
+    signed = RawSigner(config, departure, random_bytes).request(
+        doc.requests[scenario.base].message(), now
+    )
+    if scenario.extra_signature is not None:
+        extra = scenario.extra_signature
+        second = MessageDeparture(
+            components=components_of(extra.components, extra.label),
+            parameters=extra.parameters,
+            signature_agent=OMIT,
+            keep_signatures=True,
+        )
+        config = _config(keys[extra.kid], doc.signer.identity, extra.label)
+        signed = RawSigner(config, second, random_bytes).request(signed, now)
+    return signed if scenario.after_signing is None else scenario.after_signing.applied_to(signed)
+
+
+def baseline_request(
+    doc: ScenariosDocument,
+    keys: Mapping[str, Ed25519Key],
+    now: UnixSeconds,
+    random_bytes: RandomBytes = secrets.token_bytes,
+) -> HTTPRequest:
+    """The ``post`` request, signed as the baseline scenario."""
+    baseline = RequestScenario(id="R00", name="Baseline", basis="", expected=passing())
+    return sign_request_scenario(doc, baseline, keys, now, random_bytes)
+
+
+# ── responses ──────────────────────────────────────────────────────────────
+
+
+def sign_response_scenario(
+    doc: ScenariosDocument,
+    scenario: ResponseScenario,
+    keys: Mapping[str, Ed25519Key],
+    now: UnixSeconds,
+    random_bytes: RandomBytes = secrets.token_bytes,
+) -> tuple[RequestDoc, ResponseDoc]:
+    """Signs one response scenario at ``now``.
+
+    The request is the ``post`` request, signed as the baseline unless the
+    scenario's ``request`` is ``unbound``. Returns the request and the
+    response as the verifier is shown them.
+    """
+    if scenario.request == "bound":
+        request = baseline_request(doc, keys, now, random_bytes)
+    else:
+        request = doc.requests["post"].message()
+    label = scenario.label
+    departure = MessageDeparture(
+        components=components_of(
+            scenario.components or doc.response_components[scenario.request], label
+        ),
+        parameters=doc.response_parameters.merged(scenario.parameters),
+    )
+    config = _config(keys[doc.responder.kid], doc.responder.identity, label)
+    signed = RawSigner(config, departure, random_bytes).response(doc.response.message(request), now)
+    edits = scenario.after_signing
+    shown = signed if edits is None else edits.applied_to(signed)
+    return RequestDoc.of(shown.request), ResponseDoc.of(shown)
+
+
+# ── directories ────────────────────────────────────────────────────────────
+
+
+def sign_directory(keys: Sequence[Ed25519Key], root: str, now: UnixSeconds) -> DirectoryDoc:
+    """The directory served under ``root``, published with ``keys`` at ``now``.
+
+    ``root`` is an origin, which the profile publishes. A scenario can also
+    list a directory under a root that isn't one, such as ``http://`` or a
+    port, which only a verifier that skips the origin rule fetches; that one
+    is signed for the root's own authority.
+    """
+    try:
+        origin = Origin.parse(root)
+    except ConfigurationError:
+        return sign_directory_body(build_directory(keys), keys, root, now)
+    return DirectoryDoc.of(origin.directory_url, publish_directory(origin, keys, now=now))
+
+
+@dataclass(frozen=True, slots=True, kw_only=True)
+class DirectoryDeparture:
+    """What a raw directory signs differently from the profile.
+
+    ``created`` and ``expires`` are offsets in seconds from the clock, and
+    ``expires`` defaults to the profile's lifetime. ``components``, ``alg``
+    (``OMIT`` leaves it out), ``content_type``, and ``content_digest`` (sent
+    as given, unchecked) replace the profile's. ``authority`` signs for
+    another ``"@authority"`` than the origin's own.
+    """
+
+    components: tuple[ComponentId, ...] | None = None
+    created: int = 0
+    expires: int = DEFAULT_PUBLISH.lifetime
+    alg: str | Omit = ALGORITHM
+    content_type: str = DIRECTORY_MEDIA_TYPE
+    content_digest: str | None = None
+    authority: str | None = None
+
+    def _params(self, i: int, key: Ed25519Key, now: UnixSeconds) -> SignatureParams:
+        """What key number ``i`` signs, as the profile would with this departure."""
+        created, expires = UnixSeconds(now + self.created), UnixSeconds(now + self.expires)
+        params = DIRECTORY.params(Stamp(f"key{i}", key.thumbprint, created, expires))
+        components = params.components if self.components is None else self.components
+        return replace(params, components=components, alg=self.alg)
+
+
+#: The profile's own directory signing, departing from nothing.
+PROFILE_DIRECTORY = DirectoryDeparture()
+
+
+def sign_directory_body(
+    body: bytes,
+    keys: Sequence[Ed25519Key],
+    root: Origin | str,
+    now: UnixSeconds,
+    departure: DirectoryDeparture = PROFILE_DIRECTORY,
+) -> DirectoryDoc:
+    """``body`` served under ``root``, signed by each of ``keys`` as ``departure`` says.
+
+    ``root`` is an origin, or a URL root such as ``https://host:8443``.
+
+    ``body`` is any bytes, so a test can sign a JWK Set the keys don't match.
+    This is the raw directory signer: :func:`~..directory.publish_directory`
+    is the profile's.
+    """
+    lines = HeaderLines(
+        [
+            ("Content-Type", departure.content_type),
+            ("Cache-Control", f"max-age={DEFAULT_PUBLISH.max_age}"),
+            ("Content-Digest", departure.content_digest or content_digest(body)),
+        ]
+    )
+    url = f"{root}{DIRECTORY_PATH}"
+    authority = departure.authority or urlsplit(url).netloc
+    request = HTTPRequest("GET", f"https://{authority}{DIRECTORY_PATH}")
+    unsigned = HTTPResponse(200, lines, b"", request)
+    signers = [(key, departure._params(i, key, now)) for i, key in enumerate(keys, start=1)]
+    signed = sign_each_unchecked(unsigned, signers)
+    return DirectoryDoc(url=url, status=200, headers=signed.headers, body=body)
+
+
+def _departure(scenario: DirectoryScenario) -> DirectoryDeparture:
+    parameters = scenario.parameters or SignatureParameters()
+    return DirectoryDeparture(
+        components=None if scenario.components is None else components_of(scenario.components, ""),
+        created=_offset(parameters.created, 0),
+        expires=_offset(parameters.expires, DEFAULT_PUBLISH.lifetime),
+        content_type=scenario.content_type or DIRECTORY_MEDIA_TYPE,
+        authority=scenario.authority,
+    )
+
+
+def sign_directory_scenario(
+    doc: ScenariosDocument,
+    scenario: DirectoryScenario,
+    keys: Mapping[str, Ed25519Key],
+    now: UnixSeconds,
+) -> DirectoryDoc:
+    """Signs one directory scenario at ``now``, as the signer's directory."""
+    kids = (doc.signer.kid,) if scenario.keys is None else scenario.keys
+    signing = [keys[kid] for kid in kids]
+    body = build_directory([*signing, *(scenario.unsigned_keys or ())])
+    signed = sign_directory_body(body, signing, doc.signer.identity, now, _departure(scenario))
+    edits = scenario.after_signing
+    return signed if edits is None else replace(signed, body=edits.applied_to(signed.body))
+
+
+__all__ = [
+    "PROFILE_DIRECTORY",
+    "PROFILE_MESSAGE",
+    "PROFILE_NONCE",
+    "DirectoryDeparture",
+    "MessageDeparture",
+    "RandomBytes",
+    "RawSigner",
+    "baseline_request",
+    "component_spec",
+    "components_of",
+    "nonce_value",
+    "parse_component_spec",
+    "sign_directory",
+    "sign_directory_body",
+    "sign_directory_scenario",
+    "sign_request_scenario",
+    "sign_response_scenario",
+    "specs",
+]
diff --git a/src/iab_agentic_primitives/web_bot_auth/directory.py b/src/iab_agentic_primitives/web_bot_auth/directory.py
new file mode 100644
index 0000000..cc13b8c
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/directory.py
@@ -0,0 +1,601 @@
+"""The signed key directory: publishing, signing, and verifying it. No I/O.
+
+An identity, an :class:`~.values.Origin`, publishes its keys only at its
+``directory_url``, ``https://<host>/.well-known/http-message-signatures-directory``,
+as a JWK Set served with the media type
+``application/http-message-signatures-directory+json``. Every function here
+takes that origin, and derives the URL and the ``"@authority";req`` it signs
+or checks from it.
+
+:func:`publish_directory` is the one way to build and sign a directory: once
+per Ed25519 key, each signature covering ``"@authority";req`` and
+``content-digest`` and carrying ``created``, ``expires``, the key's thumbprint
+as ``keyid``, ``alg="ed25519"``, and ``tag="http-message-signatures-directory"``.
+:class:`DirectoryPublisher` publishes a key source that can rotate.
+
+A fetched response is a :class:`DirectoryResponse`. :func:`verify_directory`
+verifies it for the origin it was fetched for, in four pure steps, then checks
+each key's signature:
+
+1. :func:`check_fetch_rules`: the URL, status ``200``, no
+   ``Content-Encoding``, the media type, and the size.
+2. :func:`parse_jwk_set`: the body as a JWK Set, to a :class:`KeySet`.
+3. The one signature by each key, with the directory tag and components.
+4. The directory window, from :data:`rules.DIRECTORY`.
+
+The result is a :class:`VerifiedDirectory` of that origin, which only this
+module constructs. Keys of other types, and the signatures they make, are
+ignored.
+"""
+
+from __future__ import annotations
+
+import base64
+import inspect
+import json
+from collections.abc import Awaitable, Callable, Iterable, Iterator, Mapping, Sequence
+from dataclasses import InitVar, dataclass, field
+from types import MappingProxyType
+
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+
+from . import _sig
+from ._wire import (
+    ContentDigestError,
+    SignatureFields,
+    SignatureMember,
+    check_content_digest,
+    content_digest,
+    parse_signature_fields,
+)
+from .errors import ConfigurationError, Refusal, WebBotAuthError, refuse
+from .keys import JWK, Ed25519Key, public_jwk_of, public_key_from_jwk, thumbprint
+from .message import Answer, HeaderLines, Headers, HTTPRequest, HTTPResponse
+from .presentation import no_keys_response
+from .rules import DIRECTORY, Stamp
+from .values import DIRECTORY_MEDIA_TYPE, KeyId, Origin, UnixSeconds, whole_number
+
+#: The body cap for a directory response, in bytes.
+MAX_DIRECTORY_BYTES = 256 * 1024
+#: The most keys a directory may hold.
+MAX_DIRECTORY_KEYS = 16
+#: The default Cache-Control max-age of a directory response, in seconds.
+DEFAULT_DIRECTORY_MAX_AGE = 300
+#: The default lifetime of a directory signature, in seconds.
+DEFAULT_DIRECTORY_LIFETIME = 86400
+
+
+@dataclass(frozen=True, slots=True)
+class PublishPolicy:
+    """How a directory server signs its directory response. It checks itself.
+
+    ``lifetime`` is how long each signature is valid, 86400 s by default: a
+    whole number of seconds, 1 or more, as the directory window takes it.
+    ``max_age`` is the response's ``Cache-Control`` ``max-age``, 300 s by
+    default; ``0`` is allowed. A publisher that rotates a key waits at least
+    ``max_age`` plus the verifiers' cache age before signing with the new key.
+    A bad value raises :class:`ConfigurationError`.
+    """
+
+    lifetime: int = DEFAULT_DIRECTORY_LIFETIME
+    max_age: int = DEFAULT_DIRECTORY_MAX_AGE
+
+    def __post_init__(self) -> None:
+        DIRECTORY.window.checked_lifetime(self.lifetime)
+        whole_number("max_age", self.max_age, minimum=0)
+
+
+#: The profile's defaults for publishing a directory.
+DEFAULT_PUBLISH = PublishPolicy()
+
+
+def _positive_seconds(name: str, value: object) -> float:
+    if isinstance(value, bool) or not isinstance(value, (int, float)) or not value > 0:
+        raise ConfigurationError(f"{name} is a positive number of seconds, not {value!r}")
+    return float(value)
+
+
+@dataclass(frozen=True, slots=True)
+class FetchLimits:
+    """The profile's limits for a directory fetch. It checks itself.
+
+    5 s to connect and 10 s in total, a 256 KiB body, and at most 16 keys. The
+    resolver hands the one value to its fetcher, which applies the timeouts
+    and reads at most ``max_bytes`` plus one byte, and to
+    :func:`verify_directory`, which refuses what breaks a limit. A timeout
+    that isn't a positive number of seconds, or a size that isn't a whole
+    number, 1 or more, raises :class:`ConfigurationError`.
+    """
+
+    connect_timeout: float = 5.0
+    total_timeout: float = 10.0
+    max_bytes: int = MAX_DIRECTORY_BYTES
+    max_keys: int = MAX_DIRECTORY_KEYS
+
+    def __post_init__(self) -> None:
+        _positive_seconds("connect_timeout", self.connect_timeout)
+        _positive_seconds("total_timeout", self.total_timeout)
+        whole_number("max_bytes", self.max_bytes, minimum=1)
+        whole_number("max_keys", self.max_keys, minimum=1)
+
+
+#: The profile's limits, as :class:`FetchLimits` defaults them.
+DEFAULT_LIMITS = FetchLimits()
+
+
+@dataclass(frozen=True, slots=True, init=False)
+class DirectoryResponse:
+    """A directory response as fetched: the URL, status, field lines, body, and time.
+
+    ``body`` is the bytes on the wire, read under the body cap. ``fetched_at``
+    is when it was fetched, in Unix seconds. ``headers`` may be given as a
+    mapping, a sequence of pairs, or :class:`HeaderLines`; it is kept as
+    :class:`HeaderLines`. A verified directory keeps its response as evidence
+    (OpenProposal § 4.1.2 asks a party to keep the bytes of the key directory
+    it verified against).
+    """
+
+    url: str
+    status: int
+    headers: HeaderLines
+    body: bytes
+    fetched_at: UnixSeconds
+
+    def __init__(
+        self, url: str, status: int, headers: Headers, body: bytes, fetched_at: UnixSeconds
+    ) -> None:
+        object.__setattr__(self, "url", url)
+        object.__setattr__(self, "status", status)
+        object.__setattr__(self, "headers", HeaderLines(headers))
+        object.__setattr__(self, "body", body)
+        object.__setattr__(self, "fetched_at", fetched_at)
+
+    def document(self) -> dict[str, object]:
+        """The response as JSON-ready data.
+
+        The keys are ``url``, ``status``, ``headers`` (field lines in order, as
+        ``[name, value]`` pairs), ``body`` (the bytes as text), ``body_base64``
+        (the exact bytes, losslessly), and ``fetched_at``.
+        """
+        return {
+            "url": self.url,
+            "status": self.status,
+            "headers": [list(line) for line in self.headers],
+            "body": self.body.decode("utf-8", "replace"),
+            "body_base64": base64.b64encode(self.body).decode("ascii"),
+            "fetched_at": self.fetched_at,
+        }
+
+
+#: A key a :class:`KeySet` is built from.
+KeyInput = Ed25519Key | Ed25519PublicKey | JWK
+
+
+def _key_entry(key: KeyInput) -> tuple[KeyId, Ed25519PublicKey]:
+    """The one kid normalizer: a key and its thumbprint, whatever form it is given in."""
+    if isinstance(key, Ed25519Key):
+        return key.thumbprint, key.public_key
+    if isinstance(key, Ed25519PublicKey):
+        return KeyId(public_jwk_of(key)["kid"]), key
+    return thumbprint(key), public_key_from_jwk(key)
+
+
+class KeySet:
+    """An identity's Ed25519 public keys, by thumbprint. It is immutable.
+
+    Iterating yields the key ids. :meth:`lookup` is the one key lookup, and it
+    owns the ``key-not-found`` refusal.
+    """
+
+    __slots__ = ("_keys",)
+
+    def __init__(self, keys: Mapping[KeyId, Ed25519PublicKey]) -> None:
+        self._keys: Mapping[KeyId, Ed25519PublicKey] = MappingProxyType(dict(keys))
+
+    @classmethod
+    def from_keys(cls, keys: Iterable[KeyInput]) -> KeySet:
+        """The set of ``keys``: :class:`Ed25519Key`, public keys, or public JWKs."""
+        return cls(dict(_key_entry(key) for key in keys))
+
+    def lookup(self, kid: KeyId) -> Ed25519PublicKey:
+        """The key ``kid``; a ``key-not-found`` refusal when the set doesn't hold it."""
+        key = self._keys.get(kid)
+        if key is None:
+            raise refuse(Refusal.KEY_NOT_FOUND, f"key {kid} is not in the key set")
+        return key
+
+    def items(self) -> tuple[tuple[KeyId, Ed25519PublicKey], ...]:
+        """The ``(kid, key)`` pairs, in the order the set was built."""
+        return tuple(self._keys.items())
+
+    def __iter__(self) -> Iterator[KeyId]:
+        return iter(self._keys)
+
+    def __len__(self) -> int:
+        return len(self._keys)
+
+    def __contains__(self, kid: object) -> bool:
+        return kid in self._keys
+
+    def __repr__(self) -> str:
+        return f"KeySet({list(self._keys)!r})"
+
+
+class _Token:
+    """Proof that this module verified a directory: it alone holds the instance."""
+
+    __slots__ = ()
+
+
+_OWNER = _Token()
+
+
+@dataclass(frozen=True, slots=True)
+class VerifiedDirectory:
+    """The verified directory of ``origin``: its Ed25519 keys and the response they came from.
+
+    ``expires`` is the earliest ``expires`` among the directory's signatures:
+    the keys verify messages until then. ``evidence`` is the response, exactly
+    as verified, fetched from ``origin.directory_url``. Only
+    :func:`verify_directory` makes one: any other construction,
+    ``dataclasses.replace``, a copy, or a pickle raises ``TypeError``.
+    """
+
+    origin: Origin
+    keys: KeySet
+    expires: UnixSeconds
+    evidence: DirectoryResponse
+    _token: InitVar[_Token | None] = field(default=None, kw_only=True)
+
+    def __post_init__(self, _token: _Token | None) -> None:
+        if _token is not _OWNER:
+            raise TypeError("a VerifiedDirectory is made only by verifying a directory response")
+
+    def __reduce_ex__(self, protocol: object) -> tuple[object, ...]:
+        raise TypeError("a VerifiedDirectory can't be copied or pickled; verify again")
+
+    def key(self, kid: KeyId) -> Ed25519PublicKey:
+        """The key ``kid``; a ``key-not-found`` refusal when this origin doesn't publish it."""
+        if kid not in self.keys:
+            raise refuse(
+                Refusal.KEY_NOT_FOUND, f"key {kid} is not in the directory of {self.origin}"
+            )
+        return self.keys.lookup(kid)
+
+
+def build_directory(keys: Sequence[Ed25519Key | JWK]) -> bytes:
+    """Returns the JWK Set body for ``keys``.
+
+    Each entry is an :class:`Ed25519Key` or a public JWK. A public JWK of another
+    type is published as given; the profile's verifiers ignore it.
+    """
+    published = [k.public_jwk() if isinstance(k, Ed25519Key) else dict(k) for k in keys]
+    return json.dumps({"keys": published}, indent=2).encode()
+
+
+#: The keys a directory publishes: a list, or a callable (sync or async) that
+#: returns the current list, so a rotation shows on the next request.
+KeySource = (
+    Sequence[Ed25519Key] | Callable[[], Sequence[Ed25519Key] | Awaitable[Sequence[Ed25519Key]]]
+)
+
+
+async def current_keys(keys: KeySource) -> list[Ed25519Key]:
+    """Returns the keys a :data:`KeySource` publishes now."""
+    if callable(keys):
+        value = keys()
+        if inspect.isawaitable(value):
+            value = await value
+        return list(value)
+    return list(keys)
+
+
+def _checked_keys(keys: Sequence[Ed25519Key]) -> Sequence[Ed25519Key]:
+    """``keys`` when a verifier accepts a directory of them; :class:`ConfigurationError` else.
+
+    A directory holds at least one key and at most :data:`MAX_DIRECTORY_KEYS`,
+    each once: a key listed twice signs twice, and :func:`verify_directory`
+    refuses two signatures by one key.
+    """
+    if not keys:
+        raise ConfigurationError("a directory publishes at least one key")
+    if len(keys) > MAX_DIRECTORY_KEYS:
+        raise ConfigurationError(
+            f"a directory publishes at most {MAX_DIRECTORY_KEYS} keys, not {len(keys)}"
+        )
+    kids = [key.thumbprint for key in keys]
+    repeated = sorted({kid for kid in kids if kids.count(kid) > 1})
+    if repeated:
+        raise ConfigurationError(f"a directory lists each key once; {repeated[0]} is repeated")
+    return keys
+
+
+def _directory_request(origin: Origin) -> HTTPRequest:
+    """The request a verifier sends for ``origin``'s directory, whose ``@authority`` is signed."""
+    return HTTPRequest("GET", origin.directory_url)
+
+
+def publish_directory(
+    origin: Origin,
+    keys: Sequence[Ed25519Key],
+    *,
+    now: UnixSeconds,
+    policy: PublishPolicy = DEFAULT_PUBLISH,
+) -> Answer:
+    """``origin``'s signed directory of ``keys``, signed at ``now``, as a ``200`` answer.
+
+    ``origin`` is the server's own configured identity, never the ``Host`` a
+    client sends: each signature covers ``"@authority";req``, which keeps
+    another domain from serving the key set as its own. The headers are
+    ``Content-Type``, ``Cache-Control`` (``max-age=<policy.max_age>``),
+    ``Content-Digest``, ``Signature-Input``, and ``Signature``. It publishes
+    only what :func:`verify_directory` accepts: no keys, more than
+    :data:`MAX_DIRECTORY_KEYS`, or a key listed twice raises
+    :class:`ConfigurationError`.
+    """
+    _checked_keys(keys)
+    body = build_directory(keys)
+    lines = HeaderLines(
+        [
+            ("Content-Type", DIRECTORY_MEDIA_TYPE),
+            ("Cache-Control", f"max-age={policy.max_age}"),
+            ("Content-Digest", content_digest(body)),
+        ]
+    )
+    expires = UnixSeconds(now + policy.lifetime)
+    signers = [
+        (key, DIRECTORY.params(Stamp(f"key{i}", key.thumbprint, now, expires)))
+        for i, key in enumerate(keys, start=1)
+    ]
+    unsigned = HTTPResponse(200, lines, b"", _directory_request(origin))
+    return Answer(200, _sig.signed_by_each(unsigned, signers).headers, body)
+
+
+@dataclass(frozen=True, slots=True)
+class DirectoryPublisher:
+    """Publishes ``origin``'s directory from a key source, signed afresh on each answer.
+
+    ``keys`` is a list, or a callable (sync or async) that returns the current
+    keys, so adding or removing a key takes effect on the next answer. A list
+    that :func:`publish_directory` would refuse raises
+    :class:`ConfigurationError` when the publisher is made; a callable that
+    returns no keys answers ``503``, and one that returns keys it would refuse
+    raises :class:`ConfigurationError` on that answer. ``policy`` sets each
+    signature's lifetime and the response's ``max-age``.
+    """
+
+    origin: Origin
+    keys: KeySource
+    policy: PublishPolicy = DEFAULT_PUBLISH
+
+    def __post_init__(self) -> None:
+        if not isinstance(self.origin, Origin):
+            raise ConfigurationError(f"origin is an Origin, not {self.origin!r}")
+        if not callable(self.keys):
+            object.__setattr__(self, "keys", tuple(_checked_keys(self.keys)))
+
+    def check_signer(self, origin: Origin, keyid: KeyId) -> None:
+        """Checks that a signer of ``origin`` with the key ``keyid`` signs under this directory.
+
+        The origin must be the publisher's, and, for a list of keys, ``keyid``
+        must be among them: peers find a key only in the directory. A callable
+        key source is read on each answer, so its keys can't be checked
+        ahead of one. Raises :class:`ConfigurationError`.
+        """
+        if origin != self.origin:
+            raise ConfigurationError(
+                f"the signer signs as {origin}, but the directory is {self.origin}'s"
+            )
+        if not callable(self.keys) and keyid not in {key.thumbprint for key in self.keys}:
+            raise ConfigurationError(
+                f"the signer's key {keyid} is not in {self.origin}'s directory"
+            )
+
+    async def answer(self, now: UnixSeconds) -> Answer:
+        """The signed directory at ``now``, or ``503`` when the source has no keys now."""
+        keys = await current_keys(self.keys)
+        if not keys:
+            return no_keys_response()
+        return publish_directory(self.origin, keys, now=now, policy=self.policy)
+
+
+# ── step 1: the fetch rules ───────────────────────────────────────────────
+
+
+def check_fetch_rules(response: DirectoryResponse, origin: Origin, limits: FetchLimits) -> None:
+    """Refuses a response that breaks a fetch rule.
+
+    The rules are the URL (``origin.directory_url``, exactly), status ``200``
+    (a redirect is never followed), the content as sent (``Content-Encoding``
+    absent or ``identity``), the directory media type, and at most
+    ``limits.max_bytes`` of body.
+    """
+    if response.url != origin.directory_url:
+        raise refuse(
+            Refusal.DIRECTORY_UNAVAILABLE,
+            f"the response is from {response.url}, not {origin.directory_url}",
+        )
+    status = response.status
+    if 300 <= status < 400:
+        raise refuse(Refusal.DIRECTORY_STATUS, f"directory redirects ({status})")
+    if status != 200:
+        raise refuse(Refusal.DIRECTORY_STATUS, f"directory status {status}")
+    encoding = (response.headers.get("content-encoding") or "identity").strip().lower()
+    if encoding != "identity":
+        raise refuse(Refusal.DIRECTORY_ENCODING, f"directory Content-Encoding {encoding}")
+    media_type = response.headers.media_type()
+    if media_type != DIRECTORY_MEDIA_TYPE:
+        raise refuse(
+            Refusal.DIRECTORY_MEDIA_TYPE, f"directory media type {media_type or 'missing'}"
+        )
+    if len(response.body) > limits.max_bytes:
+        raise refuse(
+            Refusal.DIRECTORY_TOO_LARGE, f"directory body exceeds {limits.max_bytes} bytes"
+        )
+
+
+def _check_digest(response: DirectoryResponse) -> None:
+    try:
+        check_content_digest(response.headers, response.body)
+    except ContentDigestError as e:
+        raise refuse(Refusal.DIRECTORY_CONTENT_DIGEST, f"directory {e}") from e
+
+
+# ── step 2: the JWK Set ───────────────────────────────────────────────────
+
+
+def _jwk_set_members(body: bytes) -> list[object]:
+    """The ``keys`` array of a JWK Set body."""
+    try:
+        # RFC 8259 section 8.1: JSON exchanged between systems is UTF-8.
+        document = json.loads(body.decode("utf-8"))
+    except UnicodeDecodeError as e:
+        raise refuse(Refusal.DIRECTORY_FORMAT, "directory body is not UTF-8") from e
+    except (ValueError, RecursionError) as e:
+        raise refuse(Refusal.DIRECTORY_FORMAT, "directory body is not JSON") from e
+    members = document.get("keys") if isinstance(document, dict) else None
+    if not isinstance(members, list):
+        raise refuse(Refusal.DIRECTORY_FORMAT, "directory body is not a JWK Set")
+    return members
+
+
+def _directory_key(jwk: object) -> tuple[KeyId, Ed25519PublicKey] | None:
+    """The thumbprint and key of an Ed25519 JWK; ``None`` for a key the profile doesn't use."""
+    if not isinstance(jwk, dict) or jwk.get("kty") != "OKP" or jwk.get("crv") != "Ed25519":
+        return None  # a key the profile does not use (RFC 7517 section 5)
+    try:
+        kid, public_key = _key_entry(jwk)
+    except ValueError as e:
+        raise refuse(Refusal.DIRECTORY_FORMAT, f"directory Ed25519 key: {e}") from e
+    if jwk.get("kid", kid) != kid:
+        raise refuse(
+            Refusal.DIRECTORY_KID, f"directory kid {jwk['kid']!r} is not the key's thumbprint"
+        )
+    return kid, public_key
+
+
+def parse_jwk_set(body: bytes, max_keys: int) -> KeySet:
+    """The Ed25519 keys of a JWK Set body, by thumbprint.
+
+    Refuses a body that isn't a UTF-8 JWK Set, holds more than ``max_keys``
+    keys, holds an Ed25519 key whose ``kid`` isn't its thumbprint, or holds no
+    Ed25519 key. Keys of other types are skipped.
+    """
+    members = _jwk_set_members(body)
+    if len(members) > max_keys:
+        raise refuse(Refusal.DIRECTORY_TOO_MANY_KEYS, f"directory holds more than {max_keys} keys")
+    keys = dict(entry for entry in map(_directory_key, members) if entry is not None)
+    if not keys:
+        raise refuse(Refusal.DIRECTORY_NO_USABLE_KEY, "the directory holds no Ed25519 key")
+    return KeySet(keys)
+
+
+# ── step 3: the signature by each key ─────────────────────────────────────
+
+
+def _directory_fields(lines: HeaderLines) -> SignatureFields:
+    """The directory's signature fields; an unsigned response has none.
+
+    A repeated label leaves unclear which key made the signature under it, so
+    it is refused like a field that doesn't parse.
+    """
+    try:
+        fields = parse_signature_fields(lines)
+    except WebBotAuthError as e:
+        raise refuse(Refusal.DIRECTORY_SIGNATURE_PARSE, f"directory signature fields: {e}") from e
+    if fields is None:
+        return SignatureFields({}, {}, {})
+    if fields.repeated:
+        label = min(fields.repeated)
+        raise refuse(Refusal.DIRECTORY_SIGNATURE_PARSE, f"directory signature {label} is repeated")
+    return fields
+
+
+def _select_directory_signature(fields: SignatureFields, kid: KeyId) -> SignatureMember:
+    """The one directory signature by the key ``kid``, with the directory tag and components."""
+    members = [m for m in fields.values() if m.keyid == kid]
+    if len(members) != 1:
+        raise refuse(
+            Refusal.DIRECTORY_ONE_SIGNATURE_PER_KEY, f"{len(members)} directory signatures by {kid}"
+        )
+    member = members[0]
+    if member.tag != DIRECTORY.tag:
+        raise refuse(Refusal.DIRECTORY_TAG, f"directory signature by {kid} has tag {member.tag!r}")
+    if not set(DIRECTORY.components()) <= set(member.components):
+        covered = sorted(c.name for c in member.components)
+        raise refuse(Refusal.DIRECTORY_COMPONENTS, f"directory signature by {kid} covers {covered}")
+    return member
+
+
+# ── step 4 and the signature check ────────────────────────────────────────
+
+
+def _verify_key(
+    message: HTTPResponse, member: SignatureMember, public_key: Ed25519PublicKey, now: UnixSeconds
+) -> UnixSeconds:
+    """Checks one key's signature, window first; returns its ``expires``."""
+    try:
+        expires = DIRECTORY.window.check(member.created, member.expires, now)
+    except WebBotAuthError as e:
+        raise refuse(e.refusal, f"directory signature by {member.keyid}: {e}") from e
+    try:
+        _sig.verify(
+            message,
+            member,
+            public_key,
+            require_components=DIRECTORY.components(),
+            body=message.body,
+        )
+    except WebBotAuthError as e:
+        raise refuse(Refusal.DIRECTORY_SIGNATURE, str(e)) from e
+    return expires
+
+
+def verify_directory(
+    response: DirectoryResponse,
+    origin: Origin,
+    now: UnixSeconds,
+    limits: FetchLimits = DEFAULT_LIMITS,
+) -> VerifiedDirectory:
+    """Verifies ``origin``'s signed directory response and returns its keys, with the evidence.
+
+    Raises a ``403`` :class:`WebBotAuthError` when the response breaks a rule:
+    a fetch rule (the URL among them), ``Content-Digest``, the JWK Set, or the
+    signature of any Ed25519 key.
+    """
+    check_fetch_rules(response, origin, limits)
+    _check_digest(response)
+    keys = parse_jwk_set(response.body, limits.max_keys)
+    message = HTTPResponse(
+        response.status, response.headers, response.body, _directory_request(origin)
+    )
+    fields = _directory_fields(response.headers)
+    expires = min(
+        _verify_key(message, _select_directory_signature(fields, kid), public_key, now)
+        for kid, public_key in keys.items()
+    )
+    return VerifiedDirectory(origin, keys, UnixSeconds(expires), response, _token=_OWNER)
+
+
+__all__ = [
+    "DEFAULT_DIRECTORY_LIFETIME",
+    "DEFAULT_DIRECTORY_MAX_AGE",
+    "DEFAULT_LIMITS",
+    "DEFAULT_PUBLISH",
+    "MAX_DIRECTORY_BYTES",
+    "MAX_DIRECTORY_KEYS",
+    "DirectoryPublisher",
+    "DirectoryResponse",
+    "FetchLimits",
+    "KeyInput",
+    "KeySet",
+    "KeySource",
+    "PublishPolicy",
+    "VerifiedDirectory",
+    "build_directory",
+    "check_fetch_rules",
+    "current_keys",
+    "parse_jwk_set",
+    "publish_directory",
+    "verify_directory",
+]
diff --git a/src/iab_agentic_primitives/web_bot_auth/errors.py b/src/iab_agentic_primitives/web_bot_auth/errors.py
new file mode 100644
index 0000000..4bbc06f
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/errors.py
@@ -0,0 +1,183 @@
+"""The refusal vocabulary, and the errors the module raises.
+
+Every refusal a verifier sends is a member of :class:`Refusal`. A member
+carries its reason code, its HTTP status, and how it is presented: ``403`` and
+``429`` carry ``Accept-Signature``, and ``503`` carries ``Retry-After``. A
+status outside ``{400, 403, 429, 503}`` can't be expressed.
+
+:class:`WebBotAuthError` is a refusal on the wire. :class:`ConfigurationError`
+is a deploy-time mistake, such as a malformed origin, and is never sent.
+:class:`SigningError` is a message a signer refuses to sign.
+"""
+
+from __future__ import annotations
+
+import enum
+from dataclasses import dataclass
+from typing import Literal
+
+#: The statuses a verifier answers with.
+Status = Literal[400, 403, 429, 503]
+
+#: The ``Retry-After`` a ``503`` refusal carries, in seconds.
+RETRY_AFTER = 1
+
+
+@dataclass(frozen=True)
+class _Rule:
+    code: str
+    status: Status
+
+
+class Refusal(enum.Enum):
+    """Why a message is refused, with the status the refusal answers."""
+
+    # 400: a signature field doesn't parse.
+    PARSE = _Rule("parse", 400)
+
+    # 403: the signature and its Signature-Agent member.
+    SIGNATURE_MISSING = _Rule("signature-missing", 403)
+    MULTIPLE_SIGNATURES = _Rule("multiple-signatures", 403)
+    SIGNATURE_AGENT_MISSING = _Rule("signature-agent-missing", 403)
+    MULTIPLE_SIGNATURE_AGENTS = _Rule("multiple-signature-agents", 403)
+    SIGNATURE_AGENT_PARAMETERS = _Rule("signature-agent-parameters", 403)
+    SIGNATURE_AGENT_NOT_COVERED = _Rule("signature-agent-not-covered", 403)
+    SIGNATURE_AGENT_VALUE = _Rule("signature-agent-value", 403)
+
+    # 403: the signature parameters and covered components.
+    KEYID = _Rule("keyid", 403)
+    ALG = _Rule("alg", 403)
+    WINDOW = _Rule("window", 403)
+    LIFETIME = _Rule("lifetime", 403)
+    CREATED_IN_FUTURE = _Rule("created-in-future", 403)
+    EXPIRED = _Rule("expired", 403)
+    NONCE_MISSING = _Rule("nonce-missing", 403)
+    NONCE_INVALID = _Rule("nonce-invalid", 403)
+    COMPONENTS = _Rule("components", 403)
+    CONTENT_DIGEST = _Rule("content-digest", 403)
+    AUTHORITY = _Rule("authority", 403)
+
+    # 403: the key and the signature itself.
+    REJECTED_KEY = _Rule("rejected-key", 403)
+    KEY_NOT_FOUND = _Rule("key-not-found", 403)
+    SIGNATURE_INVALID = _Rule("signature-invalid", 403)
+
+    # 403: a response and the request it answers.
+    RESPONSE_NOT_BOUND = _Rule("response-not-bound", 403)
+    ORIGIN_MISMATCH = _Rule("origin-mismatch", 403)
+
+    # 403: the signed key directory and its fetch.
+    DIRECTORY_UNAVAILABLE = _Rule("directory-unavailable", 403)
+    DIRECTORY_STATUS = _Rule("directory-status", 403)
+    DIRECTORY_ENCODING = _Rule("directory-encoding", 403)
+    DIRECTORY_MEDIA_TYPE = _Rule("directory-media-type", 403)
+    DIRECTORY_TOO_LARGE = _Rule("directory-too-large", 403)
+    DIRECTORY_CONTENT_DIGEST = _Rule("directory-content-digest", 403)
+    DIRECTORY_FORMAT = _Rule("directory-format", 403)
+    DIRECTORY_TOO_MANY_KEYS = _Rule("directory-too-many-keys", 403)
+    DIRECTORY_KID = _Rule("directory-kid", 403)
+    DIRECTORY_NO_USABLE_KEY = _Rule("directory-no-usable-key", 403)
+    DIRECTORY_SIGNATURE_PARSE = _Rule("directory-signature-parse", 403)
+    DIRECTORY_ONE_SIGNATURE_PER_KEY = _Rule("directory-one-signature-per-key", 403)
+    DIRECTORY_TAG = _Rule("directory-tag", 403)
+    DIRECTORY_COMPONENTS = _Rule("directory-components", 403)
+    DIRECTORY_WINDOW = _Rule("directory-window", 403)
+    DIRECTORY_SIGNATURE = _Rule("directory-signature", 403)
+
+    # 429: the nonce was seen before for this origin.
+    NONCE_REPLAYED = _Rule("nonce-replayed", 429)
+
+    # 503: the verifier can't record the nonce now.
+    NONCE_STORE_UNAVAILABLE = _Rule("nonce-store-unavailable", 503)
+
+    @classmethod
+    def of(cls, code: str) -> Refusal:
+        """The refusal whose reason code is ``code``; ``ValueError`` for an unknown code."""
+        for refusal in cls:
+            if refusal.code == code:
+                return refusal
+        raise ValueError(f"{code!r} is not a refusal reason")
+
+    @property
+    def code(self) -> str:
+        """The machine-readable reason, such as ``"nonce-missing"``."""
+        return self.value.code
+
+    @property
+    def status(self) -> Status:
+        """The HTTP status the refusal answers."""
+        return self.value.status
+
+    @property
+    def accept_signature(self) -> bool:
+        """True when the refusal carries ``Accept-Signature``: on ``403`` and ``429``."""
+        return self.status in (403, 429)
+
+    @property
+    def retry_after(self) -> int | None:
+        """The ``Retry-After`` value in seconds, on ``503`` only."""
+        return RETRY_AFTER if self.status == 503 else None
+
+
+class WebBotAuthError(Exception):
+    """A refusal under the profile.
+
+    ``refusal`` says why. ``status`` and ``reason`` are its HTTP status and
+    reason code, and ``str(error)`` is the detail for logs. A refusal that
+    isn't a :class:`Refusal` member raises ``TypeError``. The error pickles and
+    copies, so it crosses a process pool intact.
+    """
+
+    def __init__(self, refusal: Refusal, detail: str) -> None:
+        if not isinstance(refusal, Refusal):
+            raise TypeError(f"a refusal is a Refusal member, not {refusal!r}")
+        super().__init__(refusal, detail)
+        self.refusal = refusal
+        self.detail = detail
+
+    def __str__(self) -> str:
+        return self.detail
+
+    @property
+    def status(self) -> Status:
+        return self.refusal.status
+
+    @property
+    def reason(self) -> str:
+        return self.refusal.code
+
+    def __repr__(self) -> str:
+        return f"WebBotAuthError({self.refusal}, {str(self)!r})"
+
+
+class ConfigurationError(ValueError):
+    """A deploy-time misconfiguration, such as a malformed origin or lifetime.
+
+    It is raised when a value, policy, signer, verifier, resolver, store, or
+    middleware is built, or used outside its contract, and is never sent on
+    the wire.
+    """
+
+
+class SigningError(ValueError):
+    """A message the profile can't sign, such as a body without ``Content-Type``
+    or a request whose URL isn't absolute.
+
+    The signers raise it, and only it, for a message they refuse; a library
+    error during signing is translated to it.
+    """
+
+
+def refuse(refusal: Refusal, detail: str) -> WebBotAuthError:
+    """Returns the refusal ``refusal`` with ``detail``, for the caller to raise."""
+    return WebBotAuthError(refusal, detail)
+
+
+__all__ = [
+    "RETRY_AFTER",
+    "ConfigurationError",
+    "Refusal",
+    "SigningError",
+    "Status",
+    "WebBotAuthError",
+]
diff --git a/src/iab_agentic_primitives/web_bot_auth/extra.py b/src/iab_agentic_primitives/web_bot_auth/extra.py
new file mode 100644
index 0000000..d1f4053
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/extra.py
@@ -0,0 +1,32 @@
+"""The ``wba`` extra, and the install check that refuses to import without it. No I/O.
+
+The package imports this module first. :data:`EXTRA_MODULES` is the module's
+own list of the libraries it needs, so a vendored copy, which has no package
+metadata, still checks them. The check probes each library without importing
+it: verifying with pinned keys loads no network client.
+"""
+
+from __future__ import annotations
+
+from importlib.util import find_spec
+
+__all__ = ["EXTRA_MODULES"]
+
+#: The import names of the libraries the ``wba`` extra installs, one per
+#: requirement of ``[project.optional-dependencies] wba`` in pyproject.toml.
+EXTRA_MODULES = (
+    "cryptography",
+    "http_message_signatures",
+    "http_sf",
+    "httpx",
+    "idna",
+    "joserfc",
+)
+
+# Each library is probed, not imported: verifying with pinned keys loads no network client.
+_missing = [name for name in EXTRA_MODULES if find_spec(name) is None]
+if _missing:  # pragma: no cover - exercised only without the extra
+    raise ImportError(
+        "iab_agentic_primitives.web_bot_auth needs the 'wba' extra "
+        f"(missing: {', '.join(_missing)}): pip install 'iab-agentic-primitives[wba]'"
+    )
diff --git a/src/iab_agentic_primitives/web_bot_auth/fetcher.py b/src/iab_agentic_primitives/web_bot_auth/fetcher.py
new file mode 100644
index 0000000..d30c69e
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/fetcher.py
@@ -0,0 +1,180 @@
+"""The httpx directory fetcher: one client, its TLS, the timeouts, and the bounded read.
+
+:class:`HttpxDirectoryFetcher` is the default
+:class:`~.ports.DirectoryFetcher`. It fetches exactly the URL it is given, with
+``Accept-Encoding: identity``, never follows a redirect, and reads the body as
+sent, in chunks, stopping one byte past the cap. It translates every transport
+failure, and only those, to a ``directory-unavailable`` refusal.
+
+It leaves address policy to the client: in production, inject one that guards
+against server-side request forgery, and have it raise :class:`BlockedAddress`
+for an address it refuses.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import ssl
+from dataclasses import dataclass
+from types import TracebackType
+
+import httpx
+
+from .directory import DirectoryResponse, FetchLimits
+from .errors import ConfigurationError, Refusal, refuse
+from .values import DIRECTORY_MEDIA_TYPE, Origin, UnixSeconds
+
+
+class BlockedAddress(httpx.TransportError):
+    """An address the deployment's policy doesn't let a directory fetch connect to.
+
+    A guarding transport or client raises it, for example for a private or
+    loopback address (Web Bot Auth section 6.7). The fetcher turns it into a
+    ``directory-unavailable`` refusal, and the resolver holds the failure back
+    like any other.
+    """
+
+
+#: The failures of a fetch, as httpx and the TLS and socket layers raise them.
+#: :class:`BlockedAddress` is an ``httpx.TransportError``, so it is among them.
+_TRANSPORT_ERRORS = (httpx.HTTPError, httpx.InvalidURL, ssl.SSLError, OSError)
+
+
+@dataclass(frozen=True, slots=True)
+class TLSConfig:
+    """The trust store of the client the fetcher builds.
+
+    ``ca_bundle`` replaces the system trust store with a PEM file, and
+    ``extra_ca`` adds a PEM file of trust anchors to it. The system store
+    honors ``SSL_CERT_FILE``.
+    """
+
+    ca_bundle: str | None = None
+    extra_ca: str | None = None
+
+    def ssl_context(self) -> ssl.SSLContext:
+        """A new context with these trust anchors; ``FileNotFoundError`` for a missing file."""
+        context = ssl.create_default_context(cafile=self.ca_bundle)
+        if self.extra_ca is not None:
+            context.load_verify_locations(cafile=self.extra_ca)
+        return context
+
+
+class _Borrowed(httpx.AsyncBaseTransport):
+    """A caller's transport, which closing the fetcher's client leaves open."""
+
+    def __init__(self, transport: httpx.AsyncBaseTransport) -> None:
+        self._transport = transport
+
+    async def handle_async_request(self, request: httpx.Request) -> httpx.Response:
+        return await self._transport.handle_async_request(request)
+
+    async def aclose(self) -> None:
+        """The caller closes its own transport."""
+
+
+def _client(tls: TLSConfig | None, transport: httpx.AsyncBaseTransport | None) -> httpx.AsyncClient:
+    if transport is not None:
+        if tls is not None:
+            raise ConfigurationError("a transport brings its own TLS; pass tls= or transport=")
+        return httpx.AsyncClient(transport=_Borrowed(transport), trust_env=False)
+    context = (tls or TLSConfig()).ssl_context()
+    return httpx.AsyncClient(verify=context, follow_redirects=False, trust_env=False)
+
+
+async def _bounded(response: httpx.Response, max_bytes: int) -> bytes:
+    """The body as sent on the wire, read until it is ``max_bytes`` plus one byte or ends."""
+    chunks: list[bytes] = []
+    size = 0
+    async for chunk in response.aiter_raw():
+        chunks.append(chunk)
+        size += len(chunk)
+        if size > max_bytes:
+            break
+    return b"".join(chunks)
+
+
+class HttpxDirectoryFetcher:
+    """Fetches directory responses through one ``httpx.AsyncClient``.
+
+    ``client`` is the client every fetch goes through, such as one that guards
+    against server-side request forgery; the fetcher never closes it. Without
+    one, the fetcher builds one client, once, with ``tls`` as its trust store,
+    or on ``transport`` (an ``httpx.ASGITransport`` for an in-process peer, or
+    :func:`~.testing.directory_transport` in tests), and closes that client in
+    :meth:`aclose`. It never closes a caller's transport. Passing ``tls`` or
+    ``transport`` together with ``client`` raises :class:`ConfigurationError`:
+    an injected client brings its own TLS.
+
+    The client is bound to the event loop it first fetches on.
+    """
+
+    def __init__(
+        self,
+        client: httpx.AsyncClient | None = None,
+        *,
+        tls: TLSConfig | None = None,
+        transport: httpx.AsyncBaseTransport | None = None,
+    ) -> None:
+        if client is not None and (tls is not None or transport is not None):
+            raise ConfigurationError(
+                "an injected client brings its own TLS and transport; pass client= alone"
+            )
+        self._owned = client is None
+        self._client = _client(tls, transport) if client is None else client
+
+    async def fetch(
+        self, origin: Origin, *, limits: FetchLimits, now: UnixSeconds
+    ) -> DirectoryResponse:
+        """Fetches ``origin``'s directory; a ``directory-unavailable`` refusal when it fails."""
+        url = origin.directory_url
+        try:
+            async with asyncio.timeout(limits.total_timeout):
+                return await self._get(url, limits, now)
+        except TimeoutError as e:
+            raise refuse(
+                Refusal.DIRECTORY_UNAVAILABLE, f"directory fetch of {url} timed out"
+            ) from e
+        except _TRANSPORT_ERRORS as e:
+            raise refuse(
+                Refusal.DIRECTORY_UNAVAILABLE, f"directory fetch of {url} failed: {e}"
+            ) from e
+
+    async def _get(self, url: str, limits: FetchLimits, now: UnixSeconds) -> DirectoryResponse:
+        request = self._client.build_request(
+            "GET",
+            url,
+            headers={"Accept": DIRECTORY_MEDIA_TYPE, "Accept-Encoding": "identity"},
+            timeout=httpx.Timeout(limits.total_timeout, connect=limits.connect_timeout),
+        )
+        response = await self._client.send(request, stream=True, follow_redirects=False)
+        try:
+            body = await _bounded(response, limits.max_bytes)
+        finally:
+            await response.aclose()
+        return DirectoryResponse(
+            str(response.url), response.status_code, response.headers.multi_items(), body, now
+        )
+
+    async def aclose(self) -> None:
+        """Closes the client the fetcher built; an injected client stays open."""
+        if self._owned:
+            await self._client.aclose()
+
+    async def __aenter__(self) -> HttpxDirectoryFetcher:
+        return self
+
+    async def __aexit__(
+        self,
+        exc_type: type[BaseException] | None,
+        exc: BaseException | None,
+        traceback: TracebackType | None,
+    ) -> None:
+        await self.aclose()
+
+
+__all__ = [
+    "BlockedAddress",
+    "HttpxDirectoryFetcher",
+    "TLSConfig",
+]
diff --git a/src/iab_agentic_primitives/web_bot_auth/httpx.py b/src/iab_agentic_primitives/web_bot_auth/httpx.py
new file mode 100644
index 0000000..0ce17d2
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/httpx.py
@@ -0,0 +1,422 @@
+"""httpx clients that sign every request on the wire and verify every signed response.
+
+.. code-block:: python
+
+    async with DirectoryResolver() as resolver:
+        auth = WebBotAuth(RequestSigner.of(key, "https://buyer.example.com"),
+                          ResponseVerifier(resolver))
+        async with auth.async_client() as client:
+            response = await client.post(url, json=commit)
+            verified = verified_response(response)  # a VerifiedResponse, or None
+            outcome = verification(response)  # what the client found out, whatever it was
+            sent = sent_request(response)  # the request as signed and sent
+
+:class:`WebBotAuth` is the configuration, and the library builds the client
+from it, so the signing transport is always the client's one transport. The
+transport signs each wire hop for its own URL and verifies the response to it
+against the exact request sent on that hop. A redirect, followed or not, is
+signed afresh for its own URL, so a signature never reaches another URI
+(OpenProposal § 2.8.2).
+
+The client always returns the response, with what it found out about it: a
+:class:`VerifiedResponse`, :class:`Unsigned`, or :class:`VerificationFailed`.
+It raises only :class:`ResponseNotVerified`, which carries the response, for a
+``2xx`` it couldn't verify when it is told to require signed responses.
+
+A synchronous ``httpx.Client`` verifies on a :class:`~.sync.SyncRuntime` that
+the caller owns, passed as ``runtime=``.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Coroutine, Mapping
+from dataclasses import dataclass, replace
+from typing import Final, TypedDict, Unpack
+
+import httpx
+
+from .errors import ConfigurationError, Refusal, WebBotAuthError
+from .message import HeaderLines, HTTPRequest, HTTPResponse, target_uri
+from .roles import RequestSigning, ResponseConfirmer
+from .rules import STREAMING, Streaming
+from .sync import SyncRuntime
+from .values import Origin
+from .verifier import SAME_ORIGIN, ExpectedOrigin, VerifiedResponse, is_signed
+
+#: The key of the response's :data:`Verification` in ``response.extensions``.
+EXTENSION = "web_bot_auth"
+#: The key of the request as sent, an :class:`~.message.HTTPRequest`, in ``response.extensions``.
+_SENT = "web_bot_auth.sent"
+
+#: Whose signature a response must carry, as :meth:`ResponseVerifier.verify` reads it.
+Expect = ExpectedOrigin
+
+
+@dataclass(frozen=True, slots=True)
+class Unsigned:
+    """The response carries no ``Signature-Input``, so there was nothing to verify."""
+
+
+#: The one :class:`Unsigned` value.
+UNSIGNED: Final = Unsigned()
+
+
+@dataclass(frozen=True, slots=True)
+class VerificationFailed:
+    """The response carries a signature that failed verification.
+
+    ``reason`` says why, in the profile's vocabulary, and ``detail`` is for
+    logs. It is what the client found out about the response, not a status
+    anybody sent: the response's own status is ``response.status_code``.
+    """
+
+    reason: Refusal
+    detail: str
+
+
+#: What :class:`WebBotAuth` found out about a response.
+Verification = VerifiedResponse | Unsigned | VerificationFailed
+
+
+def verification(response: httpx.Response) -> Verification | None:
+    """What a :class:`WebBotAuth` client found out about ``response``.
+
+    ``None`` when no client with a response verifier received it.
+    """
+    found = response.extensions.get(EXTENSION)
+    return found if isinstance(found, (VerifiedResponse, Unsigned, VerificationFailed)) else None
+
+
+def verified_response(response: httpx.Response) -> VerifiedResponse | None:
+    """The :class:`VerifiedResponse` that a :class:`WebBotAuth` client stored on ``response``.
+
+    ``None`` when the client didn't verify the response: it was unsigned, its
+    signature failed (:func:`verification` says why), or no client saw it.
+    """
+    found = verification(response)
+    return found if isinstance(found, VerifiedResponse) else None
+
+
+def sent_request(response: httpx.Response) -> HTTPRequest | None:
+    """The request a :class:`WebBotAuth` client sent for ``response``, exactly as on the wire.
+
+    It is the request as signed, the one the response is bound to; the
+    client's own ``response.request`` is the request before signing. ``None``
+    when no :class:`WebBotAuth` client sent it.
+    """
+    sent = response.extensions.get(_SENT)
+    return sent if isinstance(sent, HTTPRequest) else None
+
+
+class ResponseNotVerified(Exception):
+    """A ``2xx`` response the client couldn't verify, when it requires signed responses.
+
+    ``response`` is the response as received, its body read, and
+    ``verification`` says why it isn't verified. The peer did answer: a
+    caller can still read what it said, as an unverified answer.
+    """
+
+    def __init__(self, response: httpx.Response, verification: Unsigned | VerificationFailed):
+        super().__init__(response, verification)
+        self.response = response
+        self.verification = verification
+
+    def __str__(self) -> str:
+        found = self.verification
+        why = "it is unsigned" if isinstance(found, Unsigned) else f"{found.reason.code}: {found}"
+        return f"the {self.response.status_code} response is not verified: {why}"
+
+
+class ClientOptions(TypedDict, total=False):
+    """The httpx client settings :meth:`WebBotAuth.async_client` and :meth:`WebBotAuth.client`
+    pass through. Connection settings, such as TLS, proxies, and HTTP/2, belong to the
+    ``transport`` the signing transport wraps."""
+
+    auth: httpx.Auth | None
+    params: Mapping[str, str] | None
+    headers: Mapping[str, str] | None
+    cookies: httpx.Cookies | dict[str, str] | None
+    timeout: httpx.Timeout | float | None
+    follow_redirects: bool
+    max_redirects: int
+    base_url: httpx.URL | str
+    default_encoding: str
+
+
+def _checked_options(options: Mapping[str, object]) -> None:
+    """Refuses a setting that would route a request around the signing transport."""
+    unknown = sorted(set(options) - ClientOptions.__optional_keys__)
+    if unknown:
+        raise ConfigurationError(
+            f"{', '.join(unknown)} can't be set on a Web Bot Auth client: every request goes "
+            "through its signing transport; configure TLS, proxies, and HTTP/2 on the "
+            "transport= it wraps"
+        )
+
+
+def _media_type(response: httpx.Response) -> str | None:
+    return HeaderLines(response.headers.multi_items()).media_type()
+
+
+@dataclass(frozen=True, slots=True, init=False)
+class WebBotAuth:
+    """How a client signs requests and verifies responses. It builds the client.
+
+    ``signer`` signs every request; with no signer, requests go unsigned,
+    for a call that authenticates another way, such as a bearer token, and
+    the client still verifies the signed response (:meth:`verify_only`). A
+    response to an unsigned request needs no binding.
+
+    With ``response_verifier``, the client decides from a response's header
+    lines alone whether it is signed. An unsigned response is returned
+    unread, so a stream arrives as it is sent. A signed one is read and
+    verified, signature and binding to the request sent on that hop. Either
+    way the client returns the response, and :func:`verification` reads what
+    it found out: a :class:`VerifiedResponse` (which :func:`verified_response`
+    returns), :class:`Unsigned`, or :class:`VerificationFailed`.
+
+    With ``require_signed_response`` (the default), a ``2xx`` response that
+    isn't verified raises :class:`ResponseNotVerified`, which carries the
+    response. An unsigned response of a media type that ``streaming`` names,
+    which a server streams unsigned (:data:`~.rules.STREAMING`,
+    ``text/event-stream``, by default; configure the seller's
+    :class:`~.rules.Streaming`), is let
+    through, and so is every response that isn't a ``2xx``, such as a
+    refusal a verifier sends unsigned (``400``, ``403``, ``429``, ``503``),
+    a redirect, or a proxy's ``502``: its status, headers, and body are the
+    peer's own.
+
+    ``expect`` names whose signature the response carries, as
+    :meth:`ResponseVerifier.verify` reads it: ``"same-origin"`` (the
+    default), the identity of the host each hop went to; an :class:`Origin`;
+    or ``None`` for any identity.
+
+    ``runtime`` is the :class:`~.sync.SyncRuntime` of the verifier's
+    resolver, owned by the caller. With it, the client verifies on the
+    runtime's loop, so one configuration serves an ``httpx.Client`` and an
+    ``httpx.AsyncClient`` alike. Without it, only an async client can
+    verify: :meth:`client` raises :class:`ConfigurationError`.
+
+    When it verifies responses, the client sends ``Accept-Encoding:
+    identity``: ``Content-Digest`` covers the content as sent. The settings
+    are fixed when the configuration is made.
+    """
+
+    signer: RequestSigning | None
+    response_verifier: ResponseConfirmer | None
+    runtime: SyncRuntime | None
+    expect: Expect
+    require_signed_response: bool
+    streaming: Streaming
+
+    # The client's settings are its public API, one keyword each; the lint limit doesn't shape it.
+    def __init__(  # noqa: PLR0913
+        self,
+        signer: RequestSigning | None,
+        response_verifier: ResponseConfirmer | None = None,
+        *,
+        runtime: SyncRuntime | None = None,
+        expect: Expect = SAME_ORIGIN,
+        require_signed_response: bool = True,
+        streaming: Streaming = STREAMING,
+    ) -> None:
+        if signer is None and response_verifier is None:
+            raise ConfigurationError("a client that signs nothing must verify responses")
+        if expect not in (SAME_ORIGIN, None) and not isinstance(expect, Origin):
+            raise ConfigurationError(f"expect is an Origin, 'same-origin', or None, not {expect!r}")
+        if not isinstance(streaming, Streaming):
+            raise ConfigurationError(f"streaming is a Streaming, not {streaming!r}")
+        object.__setattr__(self, "signer", signer)
+        object.__setattr__(self, "response_verifier", response_verifier)
+        object.__setattr__(self, "runtime", runtime)
+        object.__setattr__(self, "expect", expect)
+        object.__setattr__(self, "require_signed_response", require_signed_response)
+        object.__setattr__(self, "streaming", streaming)
+
+    @classmethod
+    def verify_only(
+        cls,
+        response_verifier: ResponseConfirmer,
+        *,
+        runtime: SyncRuntime | None = None,
+        expect: Expect = SAME_ORIGIN,
+        require_signed_response: bool = True,
+        streaming: Streaming = STREAMING,
+    ) -> WebBotAuth:
+        """A configuration that sends requests unsigned and verifies each signed response."""
+        return cls(
+            None,
+            response_verifier,
+            runtime=runtime,
+            expect=expect,
+            require_signed_response=require_signed_response,
+            streaming=streaming,
+        )
+
+    def async_client(
+        self,
+        *,
+        transport: httpx.AsyncBaseTransport | None = None,
+        **options: Unpack[ClientOptions],
+    ) -> httpx.AsyncClient:
+        """An ``httpx.AsyncClient`` whose one transport signs and verifies each wire hop.
+
+        ``transport`` is the transport it wraps, ``httpx.AsyncHTTPTransport()``
+        by default; set TLS, proxies, and HTTP/2 there. ``options`` are the
+        client settings :class:`ClientOptions` lists; any other raises
+        :class:`ConfigurationError`. The client reads no proxy from the
+        environment, since a proxy mounted from it would bypass the signing
+        transport.
+        """
+        _checked_options(options)
+        inner = httpx.AsyncHTTPTransport() if transport is None else transport
+        return httpx.AsyncClient(transport=_AsyncTransport(self, inner), trust_env=False, **options)
+
+    def client(
+        self,
+        *,
+        transport: httpx.BaseTransport | None = None,
+        **options: Unpack[ClientOptions],
+    ) -> httpx.Client:
+        """An ``httpx.Client`` whose one transport signs and verifies each wire hop.
+
+        It takes what :meth:`async_client` takes, with ``httpx.HTTPTransport()``
+        as the default transport. It verifies on :attr:`runtime`: a
+        configuration with a response verifier and no runtime raises
+        :class:`ConfigurationError`.
+        """
+        _checked_options(options)
+        if self.response_verifier is not None and self.runtime is None:
+            raise ConfigurationError(
+                "a sync client verifies on a SyncRuntime: pass WebBotAuth(..., runtime=...)"
+            )
+        inner = httpx.HTTPTransport() if transport is None else transport
+        return httpx.Client(transport=_SyncTransport(self, inner), trust_env=False, **options)
+
+    # ── one wire hop ──────────────────────────────────────────────────────
+
+    def _wire(self, request: httpx.Request) -> tuple[httpx.Request, HTTPRequest]:
+        """The request to send on this hop, signed for its own URL, and the request as sent.
+
+        The client's request is left as it is, so nothing it builds from it,
+        such as the request that follows a redirect, carries this signature.
+        """
+        lines = HeaderLines(request.headers.multi_items())
+        if self.response_verifier is not None:
+            lines = lines.with_replaced("Accept-Encoding", "identity")
+        sent = HTTPRequest(request.method, str(request.url), lines, request.content)
+        if self.signer is None:
+            sent = replace(sent, url=target_uri(sent.url))
+        else:
+            sent = self.signer.sign(sent)
+        wire = httpx.Request(
+            sent.method,
+            sent.url,
+            headers=sent.headers.items(),
+            stream=request.stream,
+            extensions=request.extensions,
+        )
+        return wire, sent
+
+    def _verify(
+        self, verifier: ResponseConfirmer, response: httpx.Response, sent: HTTPRequest
+    ) -> Coroutine[object, object, VerifiedResponse]:
+        """Verifies the read ``response`` against ``sent``, the request this hop sent."""
+        lines = response.headers.multi_items()
+        message = HTTPResponse(response.status_code, lines, response.content, sent)
+        return verifier.verify(message, expected_origin=self.expect)
+
+    def _settle(self, response: httpx.Response, found: Verification) -> ResponseNotVerified | None:
+        """Stores ``found`` on ``response``; the error to raise when the client refuses it."""
+        response.extensions[EXTENSION] = found
+        if isinstance(found, VerifiedResponse) or not self.require_signed_response:
+            return None
+        if not response.is_success:
+            return None
+        if isinstance(found, Unsigned) and self.streaming.streams(_media_type(response)):
+            return None
+        return ResponseNotVerified(response, found)
+
+
+class _AsyncTransport(httpx.AsyncBaseTransport):
+    """Signs each wire hop for its own URL and verifies the response to it, for an async client."""
+
+    def __init__(self, auth: WebBotAuth, inner: httpx.AsyncBaseTransport) -> None:
+        self._auth: Final = auth
+        self._inner: Final = inner
+
+    async def handle_async_request(self, request: httpx.Request) -> httpx.Response:
+        await request.aread()
+        auth = self._auth
+        wire, sent = auth._wire(request)
+        response = await self._inner.handle_async_request(wire)
+        response.request, response.extensions[_SENT] = wire, sent
+        verifier = auth.response_verifier
+        if verifier is None:
+            return response
+        found: Verification = UNSIGNED
+        if is_signed(HeaderLines(response.headers.multi_items())):
+            await response.aread()
+            try:
+                verify = auth._verify(verifier, response, sent)
+                runtime = auth.runtime
+                found = await (verify if runtime is None else runtime.run_async(verify))
+            except WebBotAuthError as e:
+                found = VerificationFailed(e.refusal, e.detail)
+        refused = auth._settle(response, found)
+        if refused is not None:
+            await response.aread()
+            raise refused
+        return response
+
+    async def aclose(self) -> None:
+        await self._inner.aclose()
+
+
+class _SyncTransport(httpx.BaseTransport):
+    """Signs each wire hop for its own URL and verifies the response to it, for a sync client."""
+
+    def __init__(self, auth: WebBotAuth, inner: httpx.BaseTransport) -> None:
+        self._auth: Final = auth
+        self._inner: Final = inner
+
+    def handle_request(self, request: httpx.Request) -> httpx.Response:
+        request.read()
+        auth = self._auth
+        wire, sent = auth._wire(request)
+        response = self._inner.handle_request(wire)
+        response.request, response.extensions[_SENT] = wire, sent
+        verifier, runtime = auth.response_verifier, auth.runtime
+        if verifier is None or runtime is None:
+            return response
+        found: Verification = UNSIGNED
+        if is_signed(HeaderLines(response.headers.multi_items())):
+            response.read()
+            try:
+                found = runtime.run(auth._verify(verifier, response, sent))
+            except WebBotAuthError as e:
+                found = VerificationFailed(e.refusal, e.detail)
+        refused = auth._settle(response, found)
+        if refused is not None:
+            response.read()
+            raise refused
+        return response
+
+    def close(self) -> None:
+        self._inner.close()
+
+
+__all__ = [
+    "EXTENSION",
+    "UNSIGNED",
+    "ClientOptions",
+    "Expect",
+    "ResponseNotVerified",
+    "Unsigned",
+    "Verification",
+    "VerificationFailed",
+    "WebBotAuth",
+    "sent_request",
+    "verification",
+    "verified_response",
+]
diff --git a/src/iab_agentic_primitives/web_bot_auth/keyfile.py b/src/iab_agentic_primitives/web_bot_auth/keyfile.py
new file mode 100644
index 0000000..539f8ca
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/keyfile.py
@@ -0,0 +1,60 @@
+"""A signing key kept in a file: loaded when it exists, created once when it doesn't.
+
+:func:`load_or_create` is the one filesystem helper of the module. It publishes
+a new key file atomically, so concurrent first boots are safe: when several
+processes start together on a fresh path, such as ``uvicorn --workers N``,
+exactly one key is written, every process loads that key, and no reader ever
+sees a partly written file.
+"""
+
+from __future__ import annotations
+
+import contextlib
+import json
+import os
+import tempfile
+from pathlib import Path
+
+from .keys import Ed25519Key
+
+
+def _load(path: Path) -> Ed25519Key:
+    return Ed25519Key.from_jwk(json.loads(path.read_text()))
+
+
+def _write_private(directory: Path, key: Ed25519Key, name: str) -> Path:
+    """Writes ``key`` to a new ``0600`` file in ``directory``, flushed to disk."""
+    fd, temp = tempfile.mkstemp(dir=directory, prefix=f".{name}.", suffix=".tmp")
+    with os.fdopen(fd, "w") as f:
+        json.dump(key.private_jwk(), f)
+        f.flush()
+        os.fsync(f.fileno())
+    return Path(temp)
+
+
+def load_or_create(path: str | os.PathLike[str]) -> Ed25519Key:
+    """Loads the private JWK at ``path``, or generates a key and writes it there.
+
+    The file is created with mode ``0600``. The key is written to a temporary
+    file in the same directory, flushed to disk, and published at ``path``
+    with a hard link, which fails if the path exists. A process that loses
+    that race loads the key that won. Concurrent first boots are safe.
+    """
+    target = Path(path)
+    with contextlib.suppress(FileNotFoundError):
+        return _load(target)
+    target.parent.mkdir(parents=True, exist_ok=True)
+    key = Ed25519Key.generate()
+    temp = _write_private(target.parent, key, target.name)
+    try:
+        os.link(temp, target)
+    except FileExistsError:
+        return _load(target)
+    finally:
+        temp.unlink()
+    return key
+
+
+__all__ = [
+    "load_or_create",
+]
diff --git a/src/iab_agentic_primitives/web_bot_auth/keys.py b/src/iab_agentic_primitives/web_bot_auth/keys.py
new file mode 100644
index 0000000..af44b20
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/keys.py
@@ -0,0 +1,190 @@
+"""Ed25519 signing keys, their public JWKs, and JWK thumbprints.
+
+Every signing key under the profile is an Ed25519 key (``kty`` ``OKP``, ``crv``
+``Ed25519``), and its ``kid`` is its JWK thumbprint (RFC 7638; RFC 8037
+Appendix A.3). ``joserfc`` imports and exports the JWKs and computes the
+thumbprints; this module adds only the profile's rules: Ed25519 only, ``kid``
+equal to the thumbprint, and ``use`` ``sig``.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Mapping
+from dataclasses import dataclass, field
+from typing import Literal, NotRequired, TypedDict
+
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PrivateKey, Ed25519PublicKey
+from joserfc.errors import JoseError
+from joserfc.jwk import OKPKey
+
+from .values import KeyId
+
+#: A JWK as JSON gives it, before it is checked: member names to values of any JSON type.
+JWK = Mapping[str, object]
+
+
+class PublicJwk(TypedDict):
+    """An Ed25519 public JWK as a directory publishes it."""
+
+    kty: Literal["OKP"]
+    crv: Literal["Ed25519"]
+    kid: str
+    x: str
+    use: Literal["sig"]
+
+
+class PrivateJwk(TypedDict):
+    """An Ed25519 private JWK: the public members, which ``kid`` and ``use`` may join,
+    and the private ``d``."""
+
+    kty: Literal["OKP"]
+    crv: Literal["Ed25519"]
+    x: str
+    d: str
+    kid: NotRequired[str]
+    use: NotRequired[Literal["sig"]]
+
+
+def _members(jwk: JWK, *, private: bool) -> dict[str, str]:
+    """The members ``joserfc`` reads, checked to be an Ed25519 JWK of the right kind."""
+    if jwk.get("kty") != "OKP" or jwk.get("crv") != "Ed25519":
+        raise ValueError("not an Ed25519 JWK")
+    names = ("kty", "crv", "x", "d") if private else ("kty", "crv", "x")
+    members: dict[str, str] = {}
+    for name in names:
+        value = jwk.get(name)
+        if isinstance(value, str):
+            members[name] = value
+        elif value is not None:
+            raise ValueError(f"the JWK member {name} is not a string")
+    if private and "d" not in members:
+        raise ValueError("not an Ed25519 private JWK")
+    if not private and "x" not in members:
+        raise ValueError("not an Ed25519 public JWK")
+    return members
+
+
+def _okp(key: JWK | Ed25519PrivateKey | Ed25519PublicKey, *, private: bool) -> OKPKey:
+    try:
+        if isinstance(key, Mapping):
+            members: dict[str, str | list[str]] = dict(_members(key, private=private))
+            return OKPKey.import_key(members)
+        return OKPKey.import_key(key)
+    except JoseError as e:  # a member joserfc requires is missing or malformed
+        raise ValueError(f"not a valid Ed25519 JWK: {e}") from e
+
+
+def thumbprint(jwk: JWK) -> KeyId:
+    """Returns the RFC 7638 thumbprint of an Ed25519 public JWK."""
+    return KeyId(_okp(jwk, private=False).thumbprint())
+
+
+def public_key_from_jwk(jwk: JWK) -> Ed25519PublicKey:
+    """Loads an Ed25519 public key from a JWK; raises ``ValueError`` for any other key."""
+    key = _okp(jwk, private=False).public_key
+    if not isinstance(key, Ed25519PublicKey):  # pragma: no cover - crv is checked above
+        raise ValueError("not an Ed25519 public JWK")
+    return key
+
+
+def _member(okp: OKPKey, name: str, *, private: bool) -> str:
+    value = okp.as_dict(private=private)[name]
+    if not isinstance(value, str):  # pragma: no cover - an OKP key's x and d are strings
+        raise ValueError(f"the JWK member {name} is not a string")
+    return value
+
+
+def _publish(okp: OKPKey) -> PublicJwk:
+    return {
+        "kty": "OKP",
+        "crv": "Ed25519",
+        "kid": okp.thumbprint(),
+        "x": _member(okp, "x", private=False),
+        "use": "sig",
+    }
+
+
+def public_jwk_of(public_key: Ed25519PublicKey) -> PublicJwk:
+    """Returns the public JWK of ``public_key``, with ``kid`` set to its thumbprint."""
+    return _publish(_okp(public_key, private=False))
+
+
+@dataclass(frozen=True, slots=True, eq=False, init=False)
+class Ed25519Key:
+    """An Ed25519 private key with its thumbprint. It is immutable.
+
+    Create one with :meth:`generate`, :meth:`from_seed`, or :meth:`from_jwk`;
+    :func:`~.keyfile.load_or_create` keeps one in a file. The private key
+    isn't an attribute; :meth:`sign` uses it, and :meth:`private_jwk` exports
+    it. The thumbprint and the public key derive from it once, when the key is
+    made.
+    """
+
+    public_key: Ed25519PublicKey
+    _private_key: Ed25519PrivateKey = field(repr=False)  # gitleaks:allow
+    _okp: OKPKey = field(repr=False)
+    _public_jwk: PublicJwk = field(repr=False)
+
+    def __init__(self, private_key: Ed25519PrivateKey) -> None:
+        okp = _okp(private_key, private=True)
+        object.__setattr__(self, "_private_key", private_key)
+        object.__setattr__(self, "_okp", okp)
+        object.__setattr__(self, "public_key", private_key.public_key())
+        object.__setattr__(self, "_public_jwk", _publish(okp))
+
+    @classmethod
+    def generate(cls) -> Ed25519Key:
+        return cls(Ed25519PrivateKey.generate())
+
+    @classmethod
+    def from_seed(cls, seed: bytes) -> Ed25519Key:
+        """Loads the key whose 32-byte private seed is ``seed`` (the JWK ``d`` value)."""
+        if len(seed) != 32:
+            raise ValueError("an Ed25519 seed is 32 bytes")
+        return cls(Ed25519PrivateKey.from_private_bytes(seed))
+
+    @classmethod
+    def from_jwk(cls, jwk: JWK) -> Ed25519Key:
+        """Loads a private JWK. When ``x`` is present, it must match ``d``."""
+        private_key = _okp(jwk, private=True).private_key
+        if not isinstance(private_key, Ed25519PrivateKey):  # pragma: no cover - crv is checked
+            raise ValueError("not an Ed25519 private JWK")
+        key = cls(private_key)
+        if "x" in jwk and jwk["x"] != key._public_jwk["x"]:
+            raise ValueError("the JWK's x does not match its d")
+        return key
+
+    @property
+    def thumbprint(self) -> KeyId:
+        """The RFC 7638 thumbprint, used as ``kid`` and ``keyid``."""
+        return KeyId(self._public_jwk["kid"])
+
+    def public_jwk(self) -> PublicJwk:
+        """Returns the public JWK as a directory publishes it."""
+        return PublicJwk(**self._public_jwk)
+
+    def private_jwk(self) -> PrivateJwk:
+        """Returns the private JWK, including ``d``. Keep it secret."""
+        public = self._public_jwk
+        d = _member(self._okp, "d", private=True)
+        return PrivateJwk(
+            kty="OKP", crv="Ed25519", kid=public["kid"], x=public["x"], use="sig", d=d
+        )
+
+    def sign(self, data: bytes) -> bytes:
+        """Signs ``data`` with the private key."""
+        return self._private_key.sign(data)
+
+    def __repr__(self) -> str:
+        return f"Ed25519Key(kid={self.thumbprint!r})"
+
+
+__all__ = [
+    "JWK",
+    "Ed25519Key",
+    "PrivateJwk",
+    "PublicJwk",
+    "public_jwk_of",
+    "public_key_from_jwk",
+    "thumbprint",
+]
diff --git a/src/iab_agentic_primitives/web_bot_auth/message.py b/src/iab_agentic_primitives/web_bot_auth/message.py
new file mode 100644
index 0000000..50e776d
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/message.py
@@ -0,0 +1,192 @@
+"""The message model: immutable field lines, requests, and responses.
+
+A message has one form. :class:`HeaderLines` is an immutable, ordered sequence
+of ``(name, value)`` field lines, read once from whatever the caller passes, so
+a one-shot iterator is never read twice. :class:`HTTPRequest` and
+:class:`HTTPResponse` are frozen. The signers return a new message, and the
+verifiers take one. :class:`Answer` is what a server sends back.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Iterable, Iterator, Mapping
+from dataclasses import dataclass
+from typing import NamedTuple
+
+from .values import TargetURI
+
+#: Header input: a mapping, or ``(name, value)`` field lines, read once.
+Headers = Mapping[str, str] | Iterable[tuple[str, str]]
+
+
+def _lines_of(headers: Headers | None) -> tuple[tuple[str, str], ...]:
+    if headers is None:
+        return ()
+    if isinstance(headers, HeaderLines):
+        return headers.items()
+    items = headers.items() if isinstance(headers, Mapping) else headers
+    lines: list[tuple[str, str]] = []
+    for line in items:
+        name, value = line
+        if not isinstance(name, str) or not isinstance(value, str):
+            raise TypeError(f"a field line is a pair of str, not {line!r}")
+        lines.append((name, value))
+    return tuple(lines)
+
+
+class HeaderLines:
+    """Field lines in wire order, immutable, with case-insensitive lookup.
+
+    Build one from a mapping, a sequence of ``(name, value)`` pairs, or another
+    :class:`HeaderLines`. A name or value that isn't a ``str`` raises
+    ``TypeError``. Iterating yields the pairs, and ``lines[name]`` reads one
+    field's combined value. Nothing changes a :class:`HeaderLines`; the
+    ``with_*`` methods return a new one.
+    """
+
+    __slots__ = ("_lines",)
+
+    def __init__(self, headers: Headers | None = None) -> None:
+        self._lines = _lines_of(headers)
+
+    def items(self) -> tuple[tuple[str, str], ...]:
+        """The field lines, in order."""
+        return self._lines
+
+    def __iter__(self) -> Iterator[tuple[str, str]]:
+        return iter(self._lines)
+
+    def __len__(self) -> int:
+        return len(self._lines)
+
+    def __contains__(self, name: object) -> bool:
+        return isinstance(name, str) and any(n.lower() == name.lower() for n, _ in self._lines)
+
+    def __eq__(self, other: object) -> bool:
+        return isinstance(other, HeaderLines) and self._lines == other._lines
+
+    def __hash__(self) -> int:
+        return hash(self._lines)
+
+    def __repr__(self) -> str:
+        return f"HeaderLines({list(self._lines)!r})"
+
+    def get_all(self, name: str) -> tuple[str, ...]:
+        """The values of every line named ``name``, in order."""
+        return tuple(v for n, v in self._lines if n.lower() == name.lower())
+
+    def get(self, name: str) -> str | None:
+        """The combined value of every line named ``name``, or ``None``."""
+        values = [v.strip(" \t") for v in self.get_all(name)]
+        return ", ".join(values) if values else None
+
+    def __getitem__(self, name: str) -> str:
+        """The combined value of every line named ``name``; ``KeyError`` when there is none."""
+        value = self.get(name)
+        if value is None:
+            raise KeyError(name)
+        return value
+
+    def with_added(self, name: str, value: str) -> HeaderLines:
+        """A copy with one more line, ``name: value``, at the end."""
+        return HeaderLines((*self._lines, (name, value)))
+
+    def with_replaced(self, name: str, value: str) -> HeaderLines:
+        """A copy without any line named ``name``, and ``name: value`` at the end."""
+        kept = tuple((n, v) for n, v in self._lines if n.lower() != name.lower())
+        return HeaderLines((*kept, (name, value)))
+
+    def carries_signature_field(self) -> bool:
+        """True when the message carries ``Signature`` or ``Signature-Input``, of any scheme.
+
+        This is not whether the message is signed under the profile, which
+        :func:`~.verifier.is_signed` decides. It is whether a signer must
+        leave the message alone, and whether a response is already signed.
+        """
+        return "signature" in self or "signature-input" in self
+
+    def media_type(self) -> str | None:
+        """The ``Content-Type`` media type, lowercased and without parameters."""
+        value = self.get("content-type")
+        return None if value is None else value.split(";")[0].strip().lower()
+
+
+def target_uri(url: str) -> str:
+    """``url`` as it travels on the wire: the ``@target-uri`` every signature base takes.
+
+    It is the serialization of :class:`~.values.TargetURI`: the WHATWG URL
+    serialization an HTTP client sends, normalized per RFC 3986 § 6.2.2
+    (lowercase scheme and host, no default port, no dot segments), with no
+    userinfo, fragment, or empty query, and with the characters a client
+    sends raw, such as ``| ^ [ ] { }`` in a query, left as written. The
+    signer signs it, the verifiers recompute it, and the server's edge
+    rebuilds it, so they agree on every URL. Raises ``ValueError`` for
+    anything but an absolute ``http`` or ``https`` URL.
+    """
+    return str(TargetURI.parse(url))
+
+
+def _header_lines(headers: Headers | None) -> HeaderLines:
+    return headers if isinstance(headers, HeaderLines) else HeaderLines(headers)
+
+
+@dataclass(frozen=True, slots=True, init=False)
+class HTTPRequest:
+    """A request as the profile sees it: method, absolute URL, field lines, and body bytes.
+
+    ``headers`` may be given as a mapping, a sequence of pairs, or
+    :class:`HeaderLines`; it is read once into :class:`HeaderLines`.
+    """
+
+    method: str
+    url: str
+    headers: HeaderLines
+    body: bytes
+
+    def __init__(
+        self, method: str, url: str, headers: Headers | None = None, body: bytes = b""
+    ) -> None:
+        object.__setattr__(self, "method", method)
+        object.__setattr__(self, "url", url)
+        object.__setattr__(self, "headers", _header_lines(headers))
+        object.__setattr__(self, "body", body)
+
+
+@dataclass(frozen=True, slots=True, init=False)
+class HTTPResponse:
+    """A response, with the request it answers and binds to."""
+
+    status: int
+    headers: HeaderLines
+    body: bytes
+    request: HTTPRequest
+
+    def __init__(
+        self, status: int, headers: Headers | None, body: bytes, request: HTTPRequest
+    ) -> None:
+        object.__setattr__(self, "status", status)
+        object.__setattr__(self, "headers", _header_lines(headers))
+        object.__setattr__(self, "body", body)
+        object.__setattr__(self, "request", request)
+
+
+class Answer(NamedTuple):
+    """An answer a server sends: status, field lines, and body bytes.
+
+    Every answer the module builds is one: a refusal, a directory response,
+    and a served test response alike.
+    """
+
+    status: int
+    headers: HeaderLines
+    body: bytes
+
+
+__all__ = [
+    "Answer",
+    "HTTPRequest",
+    "HTTPResponse",
+    "HeaderLines",
+    "Headers",
+    "target_uri",
+]
diff --git a/src/iab_agentic_primitives/web_bot_auth/ports.py b/src/iab_agentic_primitives/web_bot_auth/ports.py
new file mode 100644
index 0000000..d2bf58c
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/ports.py
@@ -0,0 +1,120 @@
+"""The ports of key resolution: what a verifier asks for, and what a resolver composes. No I/O.
+
+- :class:`KeyResolver` is what a verifier calls: ``(origin, keyid)`` at
+  ``now`` to a :class:`ResolvedKey`.
+- :class:`DirectoryFetcher` fetches a directory response from the network.
+- :class:`DirectoryStore` keeps directory responses and failure deadlines as
+  plain data, and only keeps them: the resolver verifies bytes it returns
+  that it hasn't verified, and decides what a stored directory is still good
+  for.
+
+:class:`~.resolver.DirectoryResolver` composes a fetcher and a store;
+:class:`~.fetcher.HttpxDirectoryFetcher` and
+:class:`~.resolver.MemoryDirectoryStore` are the defaults.
+:func:`~.testing.check_directory_store` checks a store against this contract.
+"""
+
+from __future__ import annotations
+
+from dataclasses import dataclass
+from typing import Protocol, runtime_checkable
+
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+
+from .directory import DirectoryResponse, FetchLimits, VerifiedDirectory
+from .values import KeyId, Origin, UnixSeconds
+
+
+@dataclass(frozen=True, slots=True)
+class ResolvedKey:
+    """A resolved public key, and the verified directory it came from when there is one.
+
+    ``directory`` keeps the directory response as evidence; a resolver with no
+    directory, such as :class:`~.resolver.StaticKeyResolver`, leaves it ``None``.
+    """
+
+    public_key: Ed25519PublicKey
+    directory: VerifiedDirectory | None = None
+
+
+@runtime_checkable
+class KeyResolver(Protocol):
+    """Returns the key ``keyid`` of the identity ``origin`` at ``now``, or raises a ``403``."""
+
+    async def resolve(self, origin: Origin, keyid: KeyId, *, now: UnixSeconds) -> ResolvedKey: ...
+
+
+@runtime_checkable
+class DirectoryFetcher(Protocol):
+    """Fetches ``origin``'s directory response, from ``origin.directory_url`` exactly.
+
+    The fetcher applies ``limits``' timeouts, reads at most
+    ``limits.max_bytes`` plus one byte of body, never follows a redirect, and
+    stamps the response with ``now``. It returns any status; the fetch rules
+    are checked afterwards.
+
+    When the directory can't be fetched, it raises a ``directory-unavailable``
+    :class:`~.errors.WebBotAuthError` and nothing else; any other error is a
+    bug that propagates. A transport or client that refuses an address for
+    the deployment's policy (OpenProposal § 2.8.3, Web Bot Auth section 6.7)
+    raises :class:`~.fetcher.BlockedAddress`, which
+    :class:`~.fetcher.HttpxDirectoryFetcher` turns into that refusal like
+    every other transport failure.
+    """
+
+    async def fetch(
+        self, origin: Origin, *, limits: FetchLimits, now: UnixSeconds
+    ) -> DirectoryResponse: ...
+
+
+class DirectoryStoreUnavailable(Exception):
+    """Raised by a :class:`DirectoryStore` that can't read or write now, such as when its
+    backend is down.
+
+    The resolver reads a failed :meth:`~DirectoryStore.get` or
+    :meth:`~DirectoryStore.failure_until` as nothing stored, so it fetches the
+    directory afresh, and logs a failed :meth:`~DirectoryStore.put` or
+    :meth:`~DirectoryStore.record_failure`. Neither changes the answer: an
+    outage costs fetches, never a ``500``, and a refusal stays the refusal.
+    """
+
+
+@runtime_checkable
+class DirectoryStore(Protocol):
+    """Keeps each origin's last directory response, and when its failed fetches stop holding.
+
+    The store persists plain data and decides nothing. :meth:`put` keeps the
+    :class:`~.directory.DirectoryResponse` a resolver verified for
+    ``origin``, replacing that origin's last one and no other's; :meth:`get`
+    returns what :meth:`put` kept for ``origin``, or ``None``. A response is
+    its URL, status, field lines, body bytes, and ``fetched_at``, so a store
+    outside the process can serialize it, for example from
+    :meth:`~.directory.DirectoryResponse.document`. The resolver verifies
+    what :meth:`get` returns, as fetched and under its own limits, unless it
+    is the response the resolver already verified, then judges its expiry
+    and age; a response that doesn't verify is a cache miss.
+    :meth:`record_failure` keeps the time until which a failed fetch of
+    ``origin`` holds, and :meth:`failure_until` returns it, or ``None``.
+
+    When it can't reach its backend, a method raises
+    :class:`DirectoryStoreUnavailable` and nothing else; the resolver reads a
+    failed read as a miss and logs a failed write. Any other error is a bug
+    that propagates.
+    """
+
+    async def get(self, origin: Origin) -> DirectoryResponse | None: ...
+
+    async def put(self, origin: Origin, response: DirectoryResponse) -> None: ...
+
+    async def record_failure(self, origin: Origin, until: UnixSeconds) -> None: ...
+
+    async def failure_until(self, origin: Origin) -> UnixSeconds | None: ...
+
+
+__all__ = [
+    "DirectoryFetcher",
+    "DirectoryStore",
+    "DirectoryStoreUnavailable",
+    "KeyResolver",
+    "ResolvedKey",
+]
diff --git a/src/iab_agentic_primitives/web_bot_auth/presentation.py b/src/iab_agentic_primitives/web_bot_auth/presentation.py
new file mode 100644
index 0000000..f33a447
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/presentation.py
@@ -0,0 +1,80 @@
+"""How the module's answers look on the wire: one place for every status, header, and body.
+
+:func:`refusal_response` turns a :class:`~.errors.WebBotAuthError` into the
+response a verifier sends: the refusal's status, a JSON body
+``{"error": <reason>, "status": <status>}``, ``Accept-Signature`` on ``403``
+and ``429``, and ``Retry-After`` on ``503``. The ASGI middlewares send it, and
+a framework route returns it. No body carries an error's detail, such as a
+directory fetch error or a store's message: the detail is for logs, and the
+verifiers log it.
+
+The ASGI helpers' other answers come from here too: ``405`` on the directory
+path, ``503`` when a key source publishes no keys, ``413`` for a body over the
+limit, and ``500`` for a response the profile can't sign. Each function is
+pure and returns an :class:`~.message.Answer`.
+"""
+
+from __future__ import annotations
+
+import json
+
+from .errors import SigningError, WebBotAuthError
+from .message import Answer, HeaderLines
+from .rules import accept_signature
+
+#: The ``Retry-After`` of a directory whose key source publishes no keys, in seconds.
+NO_KEYS_RETRY_AFTER = 5
+
+
+def _json(status: int, error: str, *extra: tuple[str, str]) -> Answer:
+    """A JSON answer of ``status`` that names ``error`` and nothing else."""
+    body = json.dumps({"error": error, "status": status}).encode()
+    return Answer(status, HeaderLines([("content-type", "application/json"), *extra]), body)
+
+
+def refusal_response(error: WebBotAuthError, *, has_body: bool) -> Answer:
+    """The response that refuses a message with ``error``.
+
+    ``has_body`` says whether the refused request had a body, which sets the
+    components ``Accept-Signature`` asks for. The body names the reason and
+    the status only; ``str(error)`` stays in the logs.
+    """
+    refusal = error.refusal
+    extra: list[tuple[str, str]] = []
+    if refusal.accept_signature:
+        extra.append(("accept-signature", accept_signature(has_body=has_body)))
+    if refusal.retry_after is not None:
+        extra.append(("retry-after", str(refusal.retry_after)))
+    return _json(error.status, error.reason, *extra)
+
+
+def unsignable_response(error: SigningError) -> Answer:
+    """``500`` ``response-unsignable``: the application answered with a response the
+    profile can't sign, which is sent in place of the unsigned answer. The
+    middleware logs ``error``; the body doesn't carry it."""
+    return _json(500, "response-unsignable")
+
+
+def body_too_large_response() -> Answer:
+    """``413`` ``body-too-large``: a request body over the edge's limit."""
+    return _json(413, "body-too-large")
+
+
+def method_not_allowed_response() -> Answer:
+    """``405`` on the directory path, which answers ``GET`` and ``HEAD`` only."""
+    return Answer(405, HeaderLines([("allow", "GET, HEAD")]), b"")
+
+
+def no_keys_response() -> Answer:
+    """``503`` from a directory whose key source publishes no keys now."""
+    return Answer(503, HeaderLines([("retry-after", str(NO_KEYS_RETRY_AFTER))]), b"")
+
+
+__all__ = [
+    "NO_KEYS_RETRY_AFTER",
+    "body_too_large_response",
+    "method_not_allowed_response",
+    "no_keys_response",
+    "refusal_response",
+    "unsignable_response",
+]
diff --git a/src/iab_agentic_primitives/web_bot_auth/replay.py b/src/iab_agentic_primitives/web_bot_auth/replay.py
new file mode 100644
index 0000000..6ba90f7
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/replay.py
@@ -0,0 +1,95 @@
+"""Replay protection: one use per ``(origin, nonce)`` pair.
+
+A verifier refuses a nonce it has already seen for the same identity within the
+signature's lifetime, with ``429``. The store is pluggable: a deployment with
+several worker processes backs :class:`NonceStore` with shared storage, such as
+Redis ``SET key 1 NX EX ttl``.
+"""
+
+from __future__ import annotations
+
+import heapq
+import threading
+from typing import Protocol, runtime_checkable
+
+from .values import Clock, Origin, Seconds, UnixSeconds, system_clock, whole_number
+
+
+class NonceStoreUnavailable(Exception):
+    """Raised by a :class:`NonceStore` that can't record a nonce now, such as a full store.
+
+    The verifier answers ``503``, not ``429``: the nonce isn't a replay, and a
+    client that re-signs would only be refused again.
+    """
+
+
+@runtime_checkable
+class NonceStore(Protocol):
+    """Records each ``(origin, nonce)`` pair once.
+
+    ``check_and_record`` is atomic: it records the pair and returns ``True``
+    when the pair is new, and returns ``False`` without changing anything when
+    the pair is already recorded. When it can't record the pair, such as when
+    its backend is down, it raises :class:`NonceStoreUnavailable` and nothing
+    else; the verifier answers that with ``503``, and any other error is a bug
+    that propagates. ``ttl`` is how long, in seconds, the store must keep the
+    pair: the signature's remaining lifetime plus the clock skew.
+    """
+
+    async def check_and_record(self, origin: Origin, nonce: str, ttl: Seconds) -> bool: ...
+
+
+class MemoryNonceStore:
+    """An in-process :class:`NonceStore` whose entries expire after their TTL.
+
+    It is safe across threads and event loops within one process. Use shared
+    storage when several processes verify requests for the same identity. When
+    it holds ``max_entries`` live pairs, it raises :class:`NonceStoreUnavailable`
+    instead of forgetting one. ``max_entries`` is a whole number, 1 or more;
+    anything else raises :class:`ConfigurationError`.
+    """
+
+    def __init__(self, *, clock: Clock = system_clock, max_entries: int = 1_000_000) -> None:
+        self._clock = clock
+        self._max_entries = whole_number("max_entries", max_entries, minimum=1)
+        self._seen: dict[tuple[Origin, str], UnixSeconds] = {}
+        self._expiry: list[tuple[UnixSeconds, tuple[Origin, str]]] = []
+        self._lock = threading.Lock()
+
+    def _evict(self, now: UnixSeconds) -> None:
+        while self._expiry and self._expiry[0][0] < now:
+            deadline, entry = heapq.heappop(self._expiry)
+            if self._seen.get(entry) == deadline:
+                del self._seen[entry]
+
+    def _check_and_record(self, origin: Origin, nonce: str, ttl: Seconds) -> bool:
+        now = self._clock()
+        entry = (origin, nonce)
+        with self._lock:
+            self._evict(now)
+            if entry in self._seen:
+                return False
+            if len(self._seen) >= self._max_entries:
+                # Refuse rather than forget: a full store must not admit a replay.
+                raise NonceStoreUnavailable(f"the nonce store holds {self._max_entries} entries")
+            # At least one second, so a clock with whole-second resolution keeps the pair
+            # through the tick it was recorded in.
+            deadline = UnixSeconds(now + max(ttl, 1))
+            self._seen[entry] = deadline
+            heapq.heappush(self._expiry, (deadline, entry))
+            return True
+
+    async def check_and_record(self, origin: Origin, nonce: str, ttl: Seconds) -> bool:
+        return self._check_and_record(origin, nonce, ttl)
+
+    def __len__(self) -> int:
+        with self._lock:
+            self._evict(self._clock())
+            return len(self._seen)
+
+
+__all__ = [
+    "MemoryNonceStore",
+    "NonceStore",
+    "NonceStoreUnavailable",
+]
diff --git a/src/iab_agentic_primitives/web_bot_auth/resolver.py b/src/iab_agentic_primitives/web_bot_auth/resolver.py
new file mode 100644
index 0000000..eca48e2
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/resolver.py
@@ -0,0 +1,436 @@
+"""Key resolution: from ``(origin, keyid)`` to an Ed25519 public key.
+
+:class:`DirectoryResolver` composes a :class:`~.ports.DirectoryFetcher` and a
+:class:`~.ports.DirectoryStore`, and owns every rule about what a stored
+directory is good for (OpenProposal § 2.8.3):
+
+- It fetches exactly ``https://<host>/.well-known/http-message-signatures-directory``
+  and verifies the response with :func:`~.directory.verify_directory` under
+  one :class:`~.directory.FetchLimits`, at the time it was fetched.
+- A directory is verified once, when it enters the process: from the fetcher,
+  or as bytes the store returns that the resolver hasn't verified. The
+  resolver holds each :class:`~.directory.VerifiedDirectory` in memory by
+  origin, and answers from it while the store returns the response it was
+  verified from. Stored bytes it doesn't hold are verified, as fetched, for
+  the origin it asked for and under its own limits; a stored response that
+  doesn't verify is a cache miss.
+- The resolver's own clock stamps each fetch and judges the cache: a
+  directory younger than :attr:`CachePolicy.max_cache_age` answers every
+  keyid without a fetch. A directory that resolves without the key replaces
+  the stored one. A failed fetch does not evict it, and isn't retried for
+  :attr:`CachePolicy.negative_ttl` seconds.
+- The time a verifier judges at decides only whether the directory still
+  holds then: it answers until the earliest ``expires`` among its signatures.
+- Concurrent resolves of one origin share one fetch.
+
+Keys are always looked up by the pair ``(origin, keyid)``, never by ``keyid``
+alone. :class:`StaticKeyResolver` resolves from keys pinned by configuration,
+with no network.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import logging
+import threading
+from collections.abc import Awaitable, Callable, Iterable, Mapping
+from dataclasses import dataclass
+from functools import partial
+from types import TracebackType
+from typing import TYPE_CHECKING, Final
+
+from .directory import (
+    DEFAULT_LIMITS,
+    DirectoryResponse,
+    FetchLimits,
+    KeyInput,
+    KeySet,
+    VerifiedDirectory,
+    verify_directory,
+)
+from .errors import ConfigurationError, Refusal, WebBotAuthError, refuse
+from .ports import (
+    DirectoryFetcher,
+    DirectoryStore,
+    DirectoryStoreUnavailable,
+    KeyResolver,
+    ResolvedKey,
+)
+from .rules import CACHE
+from .values import Clock, KeyId, Origin, UnixSeconds, system_clock, whole_number
+
+if TYPE_CHECKING:
+    from .fetcher import HttpxDirectoryFetcher
+
+logger = logging.getLogger(__name__)
+
+#: The most verified directories a resolver holds in memory; past it, the oldest goes.
+_MAX_HELD: Final = 10_000
+
+
+@dataclass(frozen=True, slots=True)
+class CachePolicy:
+    """How long a resolver keeps a directory. It checks itself.
+
+    A directory answers without a fetch for ``max_cache_age`` seconds after it
+    was fetched (300 by default), and a failed fetch isn't retried for
+    ``negative_ttl`` seconds (60 by default), as OpenProposal § 2.8.3 states.
+    Each is a whole number of seconds, 0 or more; anything else raises
+    :class:`ConfigurationError`.
+    """
+
+    max_cache_age: int = CACHE.fresh_for
+    negative_ttl: int = CACHE.retry_after_failure
+
+    def __post_init__(self) -> None:
+        whole_number("max_cache_age", self.max_cache_age, minimum=0)
+        whole_number("negative_ttl", self.negative_ttl, minimum=0)
+
+
+#: The profile's cache rules.
+DEFAULT_CACHE: Final = CachePolicy()
+
+
+class MemoryDirectoryStore:
+    """An in-process :class:`~.ports.DirectoryStore`, bounded, and safe across threads.
+
+    When either map holds ``max_entries`` origins, a new entry pushes out the
+    one written longest ago. ``max_entries`` is a whole number, 1 or more;
+    anything else raises :class:`ConfigurationError`.
+    """
+
+    __slots__ = ("_directories", "_failures", "_lock", "_max_entries")
+
+    def __init__(self, *, max_entries: int = 10_000) -> None:
+        self._max_entries: Final = whole_number("max_entries", max_entries, minimum=1)
+        self._directories: dict[Origin, DirectoryResponse] = {}
+        self._failures: dict[Origin, UnixSeconds] = {}
+        self._lock: Final = threading.Lock()
+
+    async def get(self, origin: Origin) -> DirectoryResponse | None:
+        with self._lock:
+            return self._directories.get(origin)
+
+    async def put(self, origin: Origin, response: DirectoryResponse) -> None:
+        with self._lock:
+            self._directories.pop(origin, None)
+            self._directories[origin] = response
+            self._bound(self._directories)
+
+    async def record_failure(self, origin: Origin, until: UnixSeconds) -> None:
+        with self._lock:
+            self._failures.pop(origin, None)
+            self._failures[origin] = until
+            self._bound(self._failures)
+
+    async def failure_until(self, origin: Origin) -> UnixSeconds | None:
+        with self._lock:
+            return self._failures.get(origin)
+
+    def clear(self) -> None:
+        """Forgets every directory and failure."""
+        with self._lock:
+            self._directories.clear()
+            self._failures.clear()
+
+    def _bound(self, entries: dict[Origin, DirectoryResponse] | dict[Origin, UnixSeconds]) -> None:
+        """Drops the oldest entries while ``entries`` is over the bound."""
+        while len(entries) > self._max_entries:
+            del entries[next(iter(entries))]
+
+
+class DirectoryResolver:
+    """Resolves keys from each origin's signed key directory, through a fetcher and a store.
+
+    ``fetcher`` fetches directory responses; without one, the resolver builds
+    an :class:`~.fetcher.HttpxDirectoryFetcher` with a plain client and closes
+    it in :meth:`aclose`. An injected fetcher belongs to the caller. ``store``
+    keeps each origin's directory response; :class:`MemoryDirectoryStore` by
+    default. ``limits`` holds the profile's fetch limits, ``cache`` how long a
+    directory is kept, and ``clock`` the time the resolver stamps fetches with
+    and judges its cache and failures by. Each is fixed when the resolver is
+    made.
+
+    A directory is verified once, when it enters the process. The resolver
+    holds each verified directory in memory by origin, for a bounded number
+    of origins, and answers from it while the store returns the
+    response it was verified from, so a cache hit or an unknown keyid costs
+    no verification. A stored response it doesn't hold, such as one another
+    worker wrote, is verified at the time it was fetched and under
+    ``limits``; a response that doesn't verify is a cache miss. A fresh
+    directory answers every keyid without a fetch, so an unknown keyid never
+    causes one. A stale but valid directory is fetched again; when that fetch
+    fails, the stored keys still answer. Only a refusal is a failed fetch; any
+    other error propagates and records nothing. A store that raises
+    :class:`~.ports.DirectoryStoreUnavailable` is read as holding nothing, so
+    the directory is fetched afresh, and its failed writes are logged; neither
+    changes the answer. The ``now`` a resolve is
+    judged at decides only whether the directory has expired by then
+    (``directory-window``); it never stamps or ages the cache.
+
+    A resolver belongs to the event loop it first resolves on, as its fetches
+    in flight and its client's connections do: a resolve on another loop
+    raises :class:`ConfigurationError`, and so does one after :meth:`aclose`.
+    Synchronous code reaches it through one :class:`~.sync.SyncRuntime`.
+    """
+
+    __slots__ = (
+        "_cache",
+        "_clock",
+        "_closed",
+        "_fetcher",
+        "_flights",
+        "_held",
+        "_limits",
+        "_loop",
+        "_owned",
+        "_store",
+    )
+
+    def __init__(
+        self,
+        fetcher: DirectoryFetcher | None = None,
+        store: DirectoryStore | None = None,
+        *,
+        limits: FetchLimits = DEFAULT_LIMITS,
+        cache: CachePolicy = DEFAULT_CACHE,
+        clock: Clock = system_clock,
+    ) -> None:
+        if not isinstance(limits, FetchLimits) or not isinstance(cache, CachePolicy):
+            raise ConfigurationError("limits is a FetchLimits and cache a CachePolicy")
+        owned: HttpxDirectoryFetcher | None = None
+        if fetcher is None:
+            from .fetcher import HttpxDirectoryFetcher
+
+            fetcher = owned = HttpxDirectoryFetcher()
+        self._owned: Final = owned
+        self._fetcher: Final = fetcher
+        self._store: Final = MemoryDirectoryStore() if store is None else store
+        self._limits: Final = limits
+        self._cache: Final = cache
+        self._clock: Final = clock
+        self._flights: Final[dict[Origin, asyncio.Future[VerifiedDirectory]]] = {}
+        self._held: Final[dict[Origin, VerifiedDirectory]] = {}
+        self._loop: asyncio.AbstractEventLoop | None = None
+        self._closed = False
+
+    @property
+    def fetcher(self) -> DirectoryFetcher:
+        return self._fetcher
+
+    @property
+    def store(self) -> DirectoryStore:
+        return self._store
+
+    @property
+    def limits(self) -> FetchLimits:
+        return self._limits
+
+    @property
+    def cache(self) -> CachePolicy:
+        return self._cache
+
+    @property
+    def clock(self) -> Clock:
+        return self._clock
+
+    async def resolve(self, origin: Origin, keyid: KeyId, *, now: UnixSeconds) -> ResolvedKey:
+        """Returns the key ``keyid`` of ``origin`` with the verified directory it came from.
+
+        ``now`` is the time the caller judges at: a directory that has
+        expired by then is refused ``directory-window``.
+        """
+        self._bind()
+        directory = await self._directory(origin)
+        if now > directory.expires:
+            raise refuse(
+                Refusal.DIRECTORY_WINDOW,
+                f"the directory of {origin} expired at {directory.expires}, before {now}",
+            )
+        return ResolvedKey(directory.key(keyid), directory)
+
+    def _bind(self) -> None:
+        """Binds the resolver to the running loop on first use; refuses any other loop."""
+        if self._closed:
+            raise ConfigurationError("the resolver is closed")
+        loop = asyncio.get_running_loop()
+        if self._loop is None:
+            self._loop = loop
+        elif self._loop is not loop:
+            raise ConfigurationError(
+                "this resolver is bound to another event loop; share it through one SyncRuntime"
+            )
+
+    def _hold(self, directory: VerifiedDirectory) -> VerifiedDirectory:
+        """Holds ``directory`` as its origin's, the newest; the oldest goes past the bound."""
+        self._held.pop(directory.origin, None)
+        self._held[directory.origin] = directory
+        while len(self._held) > _MAX_HELD:
+            del self._held[next(iter(self._held))]
+        return directory
+
+    def _known(self, response: DirectoryResponse, origin: Origin) -> VerifiedDirectory:
+        """``response`` verified for ``origin``: the held directory when it was verified from it.
+
+        Bytes the resolver doesn't hold came from outside the process, so they
+        are verified, as fetched and under the resolver's limits, and held.
+        """
+        held = self._held.get(origin)
+        if held is not None and held.evidence == response:
+            return held
+        verified = verify_directory(response, origin, response.fetched_at, self._limits)
+        return self._hold(verified)
+
+    async def _read[T](
+        self, read: Callable[[Origin], Awaitable[T | None]], origin: Origin
+    ) -> T | None:
+        """What the store's ``read`` returns for ``origin``; ``None`` when it is unavailable."""
+        try:
+            return await read(origin)
+        except DirectoryStoreUnavailable as e:
+            logger.warning(
+                "the directory store can't be read for %s, so it is a miss: %s", origin, e
+            )
+            return None
+
+    async def _write(self, write: Awaitable[None], origin: Origin) -> None:
+        """Awaits the store's ``write``; logs it when the store is unavailable, and goes on."""
+        try:
+            await write
+        except DirectoryStoreUnavailable as e:
+            logger.warning("the directory store can't be written for %s: %s", origin, e)
+
+    async def _stored(self, origin: Origin, at: UnixSeconds) -> VerifiedDirectory | None:
+        """The stored directory of ``origin``, verified once and unexpired at ``at``.
+
+        A stored response that doesn't verify, such as another origin's, is a
+        miss, and so is a store that can't be read.
+        """
+        response = await self._read(self._store.get, origin)
+        if response is None:
+            self._held.pop(origin, None)
+            return None
+        try:
+            directory = self._known(response, origin)
+        except WebBotAuthError as e:
+            logger.warning(
+                "the stored directory of %s doesn't verify, so it is fetched again: %s %s",
+                origin,
+                e.reason,
+                e,
+            )
+            return None
+        return None if at > directory.expires else directory
+
+    def _fresh(self, directory: VerifiedDirectory, at: UnixSeconds) -> bool:
+        """Younger than the cache age at ``at``; a fetch stamped after ``at`` isn't."""
+        age = at - directory.evidence.fetched_at
+        return 0 <= age < self._cache.max_cache_age
+
+    async def _directory(self, origin: Origin) -> VerifiedDirectory:
+        now = self._clock()
+        stored = await self._stored(origin, now)
+        if stored is not None and self._fresh(stored, now):
+            return stored
+        flight = self._flights.get(origin)
+        if flight is None:
+            flight = asyncio.ensure_future(self._refresh(origin))
+            self._flights[origin] = flight
+            flight.add_done_callback(partial(self._landed, origin))
+        return await asyncio.shield(flight)
+
+    def _landed(self, origin: Origin, flight: asyncio.Future[VerifiedDirectory]) -> None:
+        if self._flights.get(origin) is flight:
+            del self._flights[origin]
+        if not flight.cancelled():
+            flight.exception()  # retrieved here too, so a flight nobody awaits stays quiet
+
+    async def _failing(self, origin: Origin, at: UnixSeconds) -> bool:
+        until = await self._read(self._store.failure_until, origin)
+        return until is not None and at < until
+
+    async def _refresh(self, origin: Origin) -> VerifiedDirectory:
+        """One fetch for ``origin``; it rechecks the store, which a landed flight may fill."""
+        now = self._clock()
+        stored = await self._stored(origin, now)
+        if stored is not None and self._fresh(stored, now):
+            return stored
+        if await self._failing(origin, now):
+            if stored is not None:
+                return stored
+            raise refuse(
+                Refusal.DIRECTORY_UNAVAILABLE, f"the directory of {origin} failed recently"
+            )
+        try:
+            response = await self._fetcher.fetch(origin, limits=self._limits, now=now)
+            directory = verify_directory(response, origin, response.fetched_at, self._limits)
+        except WebBotAuthError as e:
+            until = UnixSeconds(now + self._cache.negative_ttl)
+            await self._write(self._store.record_failure(origin, until), origin)
+            logger.warning(
+                "directory fetch of %s failed, not retried before %s%s: %s %s",
+                origin,
+                until,
+                "; the stored keys still answer" if stored is not None else "",
+                e.reason,
+                e,
+            )
+            if stored is not None:
+                return stored  # a failed fetch doesn't evict
+            raise
+        # A directory that resolves is evidence: it replaces the entry, with or without the key.
+        await self._write(self._store.put(origin, response), origin)
+        return self._hold(directory)
+
+    async def aclose(self) -> None:
+        """Closes the resolver, and the fetcher it built; an injected fetcher stays open."""
+        self._closed = True
+        if self._owned is not None:
+            await self._owned.aclose()
+
+    async def __aenter__(self) -> DirectoryResolver:
+        return self
+
+    async def __aexit__(
+        self,
+        exc_type: type[BaseException] | None,
+        exc: BaseException | None,
+        traceback: TracebackType | None,
+    ) -> None:
+        await self.aclose()
+
+
+class StaticKeyResolver(KeyResolver):
+    """Resolves keys from a fixed map of origin to keys, with no network.
+
+    Each value is a :class:`~.directory.KeySet`, such as a verified
+    directory's ``keys``, or keys to build one from. Use it in tests, or for a
+    peer whose keys you pin by configuration. Pinned keys don't expire, so
+    the time a verifier passes doesn't change the answer.
+    """
+
+    __slots__ = ("_keys",)
+
+    def __init__(self, directories: Mapping[Origin | str, KeySet | Iterable[KeyInput]]) -> None:
+        self._keys: Final[dict[Origin, KeySet]] = {
+            name if isinstance(name, Origin) else Origin.parse(name): (
+                keys if isinstance(keys, KeySet) else KeySet.from_keys(keys)
+            )
+            for name, keys in directories.items()
+        }
+
+    async def resolve(self, origin: Origin, keyid: KeyId, *, now: UnixSeconds) -> ResolvedKey:
+        """The pinned key ``keyid`` of ``origin``. Pinned keys don't expire; ``now`` goes unread."""
+        return ResolvedKey(self._keys.get(origin, _NO_KEYS).lookup(keyid))
+
+
+_NO_KEYS = KeySet({})
+
+
+__all__ = [
+    "DEFAULT_CACHE",
+    "CachePolicy",
+    "DirectoryResolver",
+    "MemoryDirectoryStore",
+    "StaticKeyResolver",
+]
diff --git a/src/iab_agentic_primitives/web_bot_auth/roles.py b/src/iab_agentic_primitives/web_bot_auth/roles.py
new file mode 100644
index 0000000..0491cfb
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/roles.py
@@ -0,0 +1,88 @@
+"""The role ports: what the edges and façades take. No I/O.
+
+- :class:`RequestConfirmer` confirms a request's signature for a server:
+  :class:`~.verifier.RequestVerifier` is one, and so is an application's own
+  confirmer, such as one that allows only listed origins.
+- :class:`ResponseConfirmer` confirms a response's signature and its binding:
+  :class:`~.verifier.ResponseVerifier` is one.
+- :class:`RequestSigning` and :class:`ResponseSigning` sign as one origin:
+  :class:`~.signer.RequestSigner` and :class:`~.signer.ResponseSigner` are
+  the profile's.
+
+An edge reads what it needs from the port it is given, such as the server's
+identity from a :class:`RequestConfirmer`, and holds no second copy.
+"""
+
+from __future__ import annotations
+
+from typing import Protocol, runtime_checkable
+
+from .message import HTTPRequest, HTTPResponse
+from .values import KeyId, Origin, ServerIdentity, UnixSeconds
+from .verifier import SAME_ORIGIN, ExpectedOrigin, VerifiedRequest, VerifiedResponse
+
+
+@runtime_checkable
+class RequestConfirmer(Protocol):
+    """Confirms a request's signature as the server ``identity``, or raises a refusal."""
+
+    @property
+    def identity(self) -> ServerIdentity: ...
+
+    async def verify(
+        self, request: HTTPRequest, *, now: UnixSeconds | None = None
+    ) -> VerifiedRequest: ...
+
+
+@runtime_checkable
+class ResponseConfirmer(Protocol):
+    """Confirms a response's signature and its binding, or raises a refusal.
+
+    ``expected_origin`` names whose signature the response must carry, as
+    :meth:`~.verifier.ResponseVerifier.verify` reads it.
+    """
+
+    async def verify(
+        self,
+        response: HTTPResponse,
+        *,
+        expected_origin: ExpectedOrigin = SAME_ORIGIN,
+        now: UnixSeconds | None = None,
+    ) -> VerifiedResponse: ...
+
+
+@runtime_checkable
+class RequestSigning(Protocol):
+    """Signs requests as ``origin``."""
+
+    @property
+    def origin(self) -> Origin: ...
+
+    def sign(
+        self, request: HTTPRequest, *, now: UnixSeconds | None = None, nonce: str | None = None
+    ) -> HTTPRequest: ...
+
+
+@runtime_checkable
+class ResponseSigning(Protocol):
+    """Signs responses as ``origin`` with the key ``keyid``, bound to the requests they answer.
+
+    A server checks ``keyid`` against the directory it publishes, so it never
+    signs with a key its peers can't find.
+    """
+
+    @property
+    def origin(self) -> Origin: ...
+
+    @property
+    def keyid(self) -> KeyId: ...
+
+    def sign(self, response: HTTPResponse, *, now: UnixSeconds | None = None) -> HTTPResponse: ...
+
+
+__all__ = [
+    "RequestConfirmer",
+    "RequestSigning",
+    "ResponseConfirmer",
+    "ResponseSigning",
+]
diff --git a/src/iab_agentic_primitives/web_bot_auth/rules.py b/src/iab_agentic_primitives/web_bot_auth/rules.py
new file mode 100644
index 0000000..6a5bb06
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/rules.py
@@ -0,0 +1,419 @@
+"""The profile's rules, stated once (OpenProposal § 2.8.2 and § 2.8.3).
+
+Each kind of signature has one rules object: :data:`REQUEST`,
+:data:`RESPONSE`, and :data:`DIRECTORY`. Its facts are class constants: the
+``tag``, the time window, and whether the signature carries a nonce. Its
+:meth:`~Rules.components_for` names the components a signature on a given
+message covers. The signers sign exactly those, and the verifiers require
+exactly those, so a signer can't emit what a verifier refuses. The rules
+classes are private: these three objects are the only rules there are, and
+:class:`Rules` types a role by the message it takes, so a request can't be
+signed under the response rules.
+
+:data:`CACHE` states how long a verifier keeps a directory (OpenProposal §
+2.8.3), and :data:`STREAMING` which responses stream unsigned.
+"""
+
+from __future__ import annotations
+
+import base64
+from abc import ABC, abstractmethod
+from dataclasses import dataclass
+from typing import ClassVar, Final
+
+from ._sig import SignatureParams
+from ._wire import ComponentId, ComponentParam, component_id, parse_signature_fields
+from .errors import ConfigurationError, Refusal, WebBotAuthError, refuse
+from .message import HeaderLines, Headers, HTTPRequest, HTTPResponse
+from .values import OMIT, KeyId, Seconds, UnixSeconds, b64url_encode, whole_number
+
+#: The ``tag`` of a request or response signature under the profile.
+SIGNATURE_TAG: Final = "web-bot-auth"
+#: The ``tag`` of a key directory response signature.
+DIRECTORY_TAG: Final = "http-message-signatures-directory"
+#: The one signature algorithm the profile uses.
+ALGORITHM: Final = "ed25519"
+#: The longest signature lifetime, ``expires - created``, in seconds.
+MAX_LIFETIME: Final = 300
+#: The clock skew a verifier allows, in seconds.
+CLOCK_SKEW: Final = 60
+#: The nonce length in bytes.
+NONCE_BYTES: Final = 64
+#: What the nonce rule requires, as a signer and a verifier say it.
+NONCE_RULE: Final = "nonce must be 64 bytes as unpadded base64url or padded base64"
+#: The key ids of the published test keys, whose private keys ship in the
+#: conformance vectors (``vectors/keys.json``). Web Bot Auth section 6.8 says
+#: they "MUST NOT be used in production": a verifier always refuses them, unless
+#: a conformance run makes it with ``verifier.CONFORMANCE_KEYS``.
+TEST_KEY_IDS: Final = frozenset(
+    {
+        KeyId("T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84"),
+        KeyId("VR0Gby4SzMlU2nttpc8Ondksz1_VWMBzuycc-DzuQHc"),
+        KeyId("-Rmj_GuEunGbO4x6GQSMCCi0P6oZ32paBkWMnvo3gDU"),
+    }
+)
+
+
+def validate_nonce(nonce: object) -> bool:
+    """True for 64 bytes as unpadded base64url or canonical padded base64.
+
+    These are the two forms the Web Bot Auth drafts use, and the two that
+    Cloudflare's ``validateNonce`` accepts.
+    """
+    if not isinstance(nonce, str) or not nonce.isascii():
+        return False
+    normalized = nonce.replace("-", "+").replace("_", "/")
+    if len(normalized) % 4 == 1:
+        return False
+    try:
+        decoded = base64.b64decode(normalized + "=" * (-len(normalized) % 4), validate=True)
+    except ValueError:
+        return False
+    if len(decoded) != NONCE_BYTES:
+        return False
+    return base64.b64encode(decoded).decode() == nonce or b64url_encode(decoded) == nonce
+
+
+@dataclass(frozen=True, slots=True)
+class Window:
+    """When a signature is valid: its ``created`` and ``expires`` against a clock.
+
+    ``max_lifetime`` caps ``expires - created`` (``None``: no cap). ``skew``
+    is allowed on ``created``, and on ``expires`` too when ``skew_on_expires``.
+    ``refusal``, when set, is the one refusal every window failure raises;
+    otherwise each rule raises its own.
+    """
+
+    max_lifetime: int | None
+    skew: int
+    skew_on_expires: bool
+    refusal: Refusal | None = None
+
+    def check(
+        self, created: UnixSeconds | None, expires: UnixSeconds | None, now: UnixSeconds
+    ) -> UnixSeconds:
+        """Refuses a window that doesn't hold at ``now``; returns ``expires``."""
+        if created is None or expires is None:
+            raise self._refuse(Refusal.WINDOW, "created and expires are required Integers")
+        if created > expires:
+            raise self._refuse(Refusal.WINDOW, "created is after expires")
+        if self.max_lifetime is not None and expires - created > self.max_lifetime:
+            raise self._refuse(
+                Refusal.LIFETIME, f"expires is more than {self.max_lifetime} s after created"
+            )
+        if created > now + self.skew:
+            raise self._refuse(Refusal.CREATED_IN_FUTURE, "created is in the future")
+        if expires < now - (self.skew if self.skew_on_expires else 0):
+            raise self._refuse(Refusal.EXPIRED, "the signature has expired")
+        return expires
+
+    def checked_lifetime(self, lifetime: object) -> Seconds:
+        """``lifetime`` when a signer may sign it: whole seconds, from 1 to ``max_lifetime``.
+
+        This is the one lifetime check every signer's configuration runs.
+        Raises :class:`ConfigurationError` for anything else.
+        """
+        checked = whole_number("lifetime", lifetime, minimum=1, maximum=self.max_lifetime)
+        return Seconds(checked)
+
+    def _refuse(self, refusal: Refusal, detail: str) -> WebBotAuthError:
+        return refuse(self.refusal or refusal, detail)
+
+
+#: The window of a request or response signature.
+MESSAGE_WINDOW: Final = Window(max_lifetime=MAX_LIFETIME, skew=CLOCK_SKEW, skew_on_expires=True)
+
+
+#: The component that covers the body, through its digest.
+CONTENT_DIGEST: Final = component_id("content-digest")
+
+
+def _body_components(has_body: bool) -> tuple[ComponentId, ...]:
+    return (component_id("content-type"), CONTENT_DIGEST) if has_body else ()
+
+
+def signature_agent_component(label: str) -> ComponentId:
+    """The component that covers the ``Signature-Agent`` member ``label``."""
+    return component_id("signature-agent", {"key": label})
+
+
+@dataclass(frozen=True, slots=True)
+class Stamp:
+    """Who signs one signature and when: its label, its key id, and its window."""
+
+    label: str
+    keyid: KeyId
+    created: UnixSeconds
+    expires: UnixSeconds
+
+
+def _checked_nonce(nonce: str | None) -> str | None:
+    if nonce is not None and not validate_nonce(nonce):
+        raise refuse(Refusal.NONCE_INVALID, NONCE_RULE)
+    return nonce
+
+
+class Rules[M: (HTTPRequest, HTTPResponse), N: (str, str | None)](ABC):
+    """The rules of a signature on a message of type ``M``, whose nonce is an ``N``:
+    a ``str`` on a request, and ``str | None`` on a response.
+
+    ``tag``, ``window``, and ``nonce_required`` are class constants.
+    """
+
+    tag: ClassVar[str] = SIGNATURE_TAG
+    window: ClassVar[Window] = MESSAGE_WINDOW
+    nonce_required: ClassVar[bool]
+
+    @abstractmethod
+    def components_for(self, message: M, label: str) -> tuple[ComponentId, ...]:
+        """The components the signature ``label`` on ``message`` covers, in signing order."""
+
+    @abstractmethod
+    def nonce_of(self, nonce: str | None) -> N:
+        """The signed ``nonce`` under the nonce rule; refuses one the rule doesn't allow."""
+
+    def missing(self, component: ComponentId) -> Refusal:
+        """The refusal for a signature that doesn't cover ``component``."""
+        return Refusal.COMPONENTS
+
+    def content(self, message: M) -> bytes:
+        """The content a signature on ``message`` covers: its body.
+
+        The signer signs this and the verifier checks this, so they agree on
+        whether a message has a body to cover.
+        """
+        return message.body
+
+    def params_for(self, message: M, stamp: Stamp, nonce: N) -> SignatureParams:
+        """What the profile signs as the signature ``stamp.label`` on ``message``."""
+        return SignatureParams(
+            label=stamp.label,
+            components=self.components_for(message, stamp.label),
+            created=stamp.created,
+            keyid=stamp.keyid,
+            expires=stamp.expires,
+            nonce=OMIT if nonce is None else nonce,
+            tag=self.tag,
+            alg=ALGORITHM,
+        )
+
+
+class _RequestRules(Rules[HTTPRequest, str]):
+    """A request signature: ``@method``, ``@target-uri``, ``@authority``, the body
+    fields when there is a body, and its ``Signature-Agent`` member, with a nonce."""
+
+    nonce_required: ClassVar[bool] = True
+
+    def nonce_of(self, nonce: str | None) -> str:
+        """The nonce, which every signed request carries in one of the two forms."""
+        checked = _checked_nonce(nonce)
+        if checked is None:
+            raise refuse(Refusal.NONCE_MISSING, "a nonce is required on every signed request")
+        return checked
+
+    def components(self, label: str, *, has_body: bool) -> tuple[ComponentId, ...]:
+        """The components the signature ``label`` covers, in signing order."""
+        derived = (
+            component_id("@method"),
+            component_id("@target-uri"),
+            component_id("@authority"),
+        )
+        return (*derived, *_body_components(has_body), signature_agent_component(label))
+
+    def components_for(self, message: HTTPRequest, label: str) -> tuple[ComponentId, ...]:
+        return self.components(label, has_body=bool(self.content(message)))
+
+
+class _ResponseRules(Rules[HTTPResponse, str | None]):
+    """A response signature: ``@status``, the request's ``@method`` and
+    ``@target-uri``, the body fields when there is a body, its
+    ``Signature-Agent`` member, and the binding to a signed request. No nonce:
+    the binding gives freshness. A response to ``HEAD`` has no body to cover."""
+
+    nonce_required: ClassVar[bool] = False
+
+    def nonce_of(self, nonce: str | None) -> str | None:
+        """No nonce, or one in one of the two forms."""
+        return _checked_nonce(nonce)
+
+    def binding(self, request_label: str) -> ComponentId:
+        """The component that binds a response to the request signature ``request_label``."""
+        return component_id("signature", {"req": True, "key": request_label})
+
+    def components(
+        self, label: str, *, has_body: bool, request_label: str | None = None
+    ) -> tuple[ComponentId, ...]:
+        """The components the signature ``label`` covers, in signing order.
+
+        ``request_label`` is the label of the request's ``web-bot-auth``
+        signature, when it carried one.
+        """
+        derived = (
+            component_id("@status"),
+            component_id("@method", {"req": True}),
+            component_id("@target-uri", {"req": True}),
+        )
+        bound = () if request_label is None else (self.binding(request_label),)
+        return (*derived, *_body_components(has_body), signature_agent_component(label), *bound)
+
+    def components_for(self, message: HTTPResponse, label: str) -> tuple[ComponentId, ...]:
+        """The components, bound to ``message.request``'s signature when it has one."""
+        request_label = web_bot_auth_label(message.request.headers)
+        has_body = bool(self.content(message))
+        return self.components(label, has_body=has_body, request_label=request_label)
+
+    def content(self, message: HTTPResponse) -> bytes:
+        """The body, except for a response to ``HEAD``, which carries no content.
+
+        A server sends a ``HEAD`` response without the body the application
+        produced (RFC 9110 section 9.3.2), so its signature covers no body
+        fields, and a verifier checks none.
+        """
+        return b"" if message.request.method.upper() == "HEAD" else message.body
+
+    def missing(self, component: ComponentId) -> Refusal:
+        """``response-not-bound`` for the binding, ``components`` for anything else."""
+        is_binding = component.name == "signature" and ("req", True) in component.params
+        return Refusal.RESPONSE_NOT_BOUND if is_binding else Refusal.COMPONENTS
+
+
+class _DirectoryRules:
+    """A directory signature: ``"@authority";req`` and ``content-digest``, with
+    no nonce. Its window has no lifetime cap and no skew on ``expires``, and
+    every window failure is ``directory-window``."""
+
+    tag: ClassVar[str] = DIRECTORY_TAG
+    window: ClassVar[Window] = Window(
+        max_lifetime=None,
+        skew=CLOCK_SKEW,
+        skew_on_expires=False,
+        refusal=Refusal.DIRECTORY_WINDOW,
+    )
+
+    def components(self) -> tuple[ComponentId, ...]:
+        """The components every directory signature covers."""
+        return (component_id("@authority", {"req": True}), CONTENT_DIGEST)
+
+    def params(self, stamp: Stamp) -> SignatureParams:
+        """What the directory signature ``stamp.label`` signs."""
+        return SignatureParams(
+            label=stamp.label,
+            components=self.components(),
+            created=stamp.created,
+            keyid=stamp.keyid,
+            expires=stamp.expires,
+            tag=self.tag,
+            alg=ALGORITHM,
+        )
+
+
+#: The rules of a request signature.
+REQUEST: Final = _RequestRules()
+#: The rules of a response signature.
+RESPONSE: Final = _ResponseRules()
+#: The rules of a key directory response signature.
+DIRECTORY: Final = _DirectoryRules()
+
+
+@dataclass(frozen=True, slots=True)
+class Streaming:
+    """The media types whose responses stream, and so go unsigned: one rule for both sides.
+
+    A server can't buffer a stream to sign it, so it passes a response of one
+    of ``media_types`` through unsigned, and a client that requires signed
+    responses takes such a response unsigned. A seller that streams another
+    type, such as ``application/x-ndjson``, and its buyers configure the same
+    value: ``SigningPolicy(streaming=...)`` on the server, and
+    ``WebBotAuth(..., streaming=...)`` on the client. :data:`STREAMING`,
+    ``text/event-stream`` alone, is the default of both. Media types are
+    compared lowercase, without parameters. Anything but a tuple of strings
+    raises :class:`ConfigurationError`.
+    """
+
+    media_types: tuple[str, ...] = ("text/event-stream",)
+
+    def __post_init__(self) -> None:
+        types = self.media_types
+        if not isinstance(types, tuple) or not all(isinstance(t, str) for t in types):
+            raise ConfigurationError(f"media_types is a tuple of media types, not {types!r}")
+        object.__setattr__(self, "media_types", tuple(t.lower() for t in types))
+
+    def streams(self, media_type: str | None) -> bool:
+        """True when a response of ``media_type`` streams, and so may go unsigned."""
+        return media_type is not None and media_type.lower() in self.media_types
+
+
+#: The profile's streaming rule: ``text/event-stream`` responses stream, unsigned.
+STREAMING: Final = Streaming()
+
+
+@dataclass(frozen=True, slots=True)
+class CacheRules:
+    """How long a verifier keeps a directory (OpenProposal § 2.8.3).
+
+    A fetched directory answers without a fetch for ``fresh_for`` seconds,
+    and after a failed fetch the origin isn't fetched again for
+    ``retry_after_failure`` seconds.
+    """
+
+    fresh_for: Seconds = Seconds(300)
+    retry_after_failure: Seconds = Seconds(60)
+
+
+#: The profile's cache rules.
+CACHE: Final = CacheRules()
+
+
+def web_bot_auth_label(headers: Headers | None) -> str | None:
+    """Returns the label of the one complete ``web-bot-auth`` signature on a message, or ``None``.
+
+    The signature is complete when ``Signature-Input`` has the one member tagged
+    ``web-bot-auth`` and ``Signature`` has a Byte Sequence under the same label.
+    Returns ``None`` when a signature field is absent or doesn't parse, when
+    there is no such member, and when there is more than one. A response binds
+    to the request's signature only when this returns a label.
+    """
+    try:
+        fields = parse_signature_fields(HeaderLines(headers))
+        return None if fields is None else fields.one_tagged(SIGNATURE_TAG).label
+    except WebBotAuthError:
+        return None
+
+
+def accept_signature(label: str = "sig1", *, has_body: bool = True) -> str:
+    """An ``Accept-Signature`` value naming what a request signature covers (RFC 9421 § 5.1)."""
+    inner = " ".join(str(c) for c in REQUEST.components(label, has_body=has_body))
+    nonce = ";nonce" if REQUEST.nonce_required else ""
+    return f'{label}=({inner});created;expires{nonce};keyid;alg="{ALGORITHM}";tag="{REQUEST.tag}"'
+
+
+__all__ = [
+    "ALGORITHM",
+    "CACHE",
+    "CLOCK_SKEW",
+    "CONTENT_DIGEST",
+    "DIRECTORY",
+    "DIRECTORY_TAG",
+    "MAX_LIFETIME",
+    "MESSAGE_WINDOW",
+    "NONCE_BYTES",
+    "NONCE_RULE",
+    "REQUEST",
+    "RESPONSE",
+    "SIGNATURE_TAG",
+    "STREAMING",
+    "TEST_KEY_IDS",
+    "CacheRules",
+    "ComponentId",
+    "ComponentParam",
+    "Rules",
+    "SignatureParams",
+    "Stamp",
+    "Streaming",
+    "Window",
+    "accept_signature",
+    "component_id",
+    "signature_agent_component",
+    "validate_nonce",
+    "web_bot_auth_label",
+]
diff --git a/src/iab_agentic_primitives/web_bot_auth/signer.py b/src/iab_agentic_primitives/web_bot_auth/signer.py
new file mode 100644
index 0000000..039aa49
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/signer.py
@@ -0,0 +1,216 @@
+"""Signing requests and responses under the profile.
+
+Both signers take a message and return a new, signed message; the caller's
+message is immutable. ``Signature-Agent`` names the signer's key directory URL,
+``https://<host>/.well-known/http-message-signatures-directory``, with no member
+parameters.
+
+A request signature covers ``@method``, ``@target-uri``, ``@authority``, and
+``"signature-agent";key=<label>``; with a body, also ``content-type`` and
+``content-digest``. Its parameters are ``created``, ``keyid``, ``alg``,
+``expires`` (300 s later), a 64-byte ``nonce``, and ``tag="web-bot-auth"``.
+
+A response signature covers ``@status``, ``"@method";req``, ``"@target-uri";req``,
+and ``"signature-agent";key=<label>``; with a body, also ``content-type`` and
+``content-digest``; and, when the request carried a ``web-bot-auth`` signature,
+``"signature";req;key=<request label>``, which binds the response to that
+exact request. It carries no nonce: the binding gives freshness.
+
+The signers sign what the profile requires and nothing else; they take no
+parameter that departs from it, so a signer can't emit what a verifier
+refuses. Each holds one frozen :class:`SignerConfig`.
+"""
+
+from __future__ import annotations
+
+import re
+import secrets
+from dataclasses import dataclass, replace
+from typing import Self
+
+from . import _sig
+from ._wire import ContentDigestError, check_content_digest, content_digest
+from .errors import ConfigurationError, SigningError
+from .keys import Ed25519Key
+from .message import HeaderLines, HTTPRequest, HTTPResponse, target_uri
+from .rules import (
+    MAX_LIFETIME,
+    MESSAGE_WINDOW,
+    NONCE_BYTES,
+    NONCE_RULE,
+    REQUEST,
+    RESPONSE,
+    Rules,
+    Stamp,
+    validate_nonce,
+)
+from .values import Clock, KeyId, Origin, UnixSeconds, b64url_encode, system_clock
+
+#: A Structured Fields Dictionary key, which a signature label must be (RFC 9651 section 3.2).
+_LABEL = re.compile(r"[a-z*][a-z0-9_.*-]*")
+
+
+def generate_nonce() -> str:
+    """Returns 64 random bytes as unpadded base64url."""
+    return b64url_encode(secrets.token_bytes(NONCE_BYTES))
+
+
+def _checked_label(label: object) -> str:
+    """A label that can key the signature fields: a Structured Fields Dictionary key."""
+    if not isinstance(label, str) or _LABEL.fullmatch(label) is None:
+        raise ConfigurationError(f"label {label!r} is not a Structured Fields Dictionary key")
+    return label
+
+
+@dataclass(frozen=True, slots=True)
+class SignerConfig:
+    """A signer's configuration, checked once when it is made, then immutable.
+
+    ``origin`` is the identity the signer signs as. ``label`` must be a
+    Structured Fields Dictionary key, and ``lifetime`` whole seconds within
+    the message window's ``max_lifetime``. A bad value raises
+    :class:`ConfigurationError`. One config can serve a request signer and a
+    response signer alike.
+    """
+
+    key: Ed25519Key
+    origin: Origin
+    label: str = "sig1"
+    lifetime: int = MAX_LIFETIME
+    clock: Clock = system_clock
+
+    def __post_init__(self) -> None:
+        if not isinstance(self.key, Ed25519Key):
+            raise ConfigurationError(f"key is an Ed25519Key, not {self.key!r}")
+        if not isinstance(self.origin, Origin):
+            raise ConfigurationError(f"origin is an Origin, not {self.origin!r}")
+        MESSAGE_WINDOW.checked_lifetime(self.lifetime)
+        _checked_label(self.label)
+
+
+def _digest_lines(lines: HeaderLines, body: bytes) -> HeaderLines:
+    """``lines`` with the body's ``Content-Digest``, added or checked."""
+    if lines.get("content-type") is None:
+        raise SigningError("a message with a body needs Content-Type, which the signature covers")
+    if "content-digest" not in lines:
+        return lines.with_added("Content-Digest", content_digest(body))
+    try:
+        check_content_digest(lines, body)
+    except ContentDigestError as e:
+        raise SigningError(f"the existing {e}; the profile requires sha-256") from e
+    return lines
+
+
+def _prepared[M: (HTTPRequest, HTTPResponse)](
+    message: M, config: SignerConfig, content: bytes
+) -> M:
+    """``message`` with the lines its signature adds: ``Content-Digest`` for ``content``,
+    the body the rules cover, and ``Signature-Agent``."""
+    lines = message.headers
+    if lines.carries_signature_field() or "signature-agent" in lines:
+        raise SigningError(
+            "the message already carries a signature field; the profile signs once per message"
+        )
+    if content:
+        lines = _digest_lines(lines, content)
+    agent = f'{config.label}="{config.origin.directory_url}"'
+    return replace(message, headers=lines.with_added("Signature-Agent", agent))
+
+
+def _sign[M: (HTTPRequest, HTTPResponse), N: (str, str | None)](
+    message: M, config: SignerConfig, rules: Rules[M, N], *, now: UnixSeconds | None, nonce: N
+) -> M:
+    """``message`` signed under ``rules`` as ``config`` says: the one signing core."""
+    created = config.clock() if now is None else now
+    prepared = _prepared(message, config, rules.content(message))
+    expires = UnixSeconds(created + config.lifetime)
+    stamp = Stamp(config.label, config.key.thumbprint, created, expires)
+    params = rules.params_for(prepared, stamp, nonce)
+    return _sig.signed(prepared, config.key, params, mode="replace")
+
+
+@dataclass(frozen=True, slots=True)
+class _Signer:
+    """What both signers hold: one frozen :class:`SignerConfig`."""
+
+    config: SignerConfig
+
+    def __post_init__(self) -> None:
+        if not isinstance(self.config, SignerConfig):
+            raise ConfigurationError(f"config is a SignerConfig, not {self.config!r}")
+
+    @classmethod
+    def of(cls, key: Ed25519Key, origin: Origin | str) -> Self:
+        """The signer of ``key`` as ``origin``, with the default label, lifetime, and clock.
+
+        A string ``origin`` is read with :meth:`Origin.parse`.
+        """
+        identity = origin if isinstance(origin, Origin) else Origin.parse(origin)
+        return cls(SignerConfig(key, identity))
+
+    @property
+    def origin(self) -> Origin:
+        """The identity the signer signs as."""
+        return self.config.origin
+
+    @property
+    def keyid(self) -> KeyId:
+        """The key id the signer signs with: its key's thumbprint."""
+        return self.config.key.thumbprint
+
+
+@dataclass(frozen=True, slots=True)
+class RequestSigner(_Signer):
+    """Signs requests as ``config.origin`` with ``config.key``. It is immutable."""
+
+    def sign(
+        self, request: HTTPRequest, *, now: UnixSeconds | None = None, nonce: str | None = None
+    ) -> HTTPRequest:
+        """Returns ``request`` signed: its field lines followed by ``Content-Digest`` (with a
+        body and none given), ``Signature-Agent``, ``Signature-Input``, and ``Signature``.
+
+        ``nonce`` is a fresh 64-byte nonce by default; one given must be in a
+        form the profile accepts. The URL is signed, and returned, as
+        :func:`~.message.target_uri` gives it: the URL as it travels on the
+        wire, which a server's edge rebuilds, so ``https://Seller.Example.com:443/x/../p``
+        is signed and returned as ``https://seller.example.com/p``. Send the
+        request to the returned URL with a client that sends it as given, as
+        httpx and ``fetch`` do; a client that re-encodes it, for example
+        ``|`` as ``%7C``, sends a URL nobody signed.
+        Raises :class:`SigningError` for a request the profile can't sign,
+        such as one whose URL isn't an absolute ``http`` or ``https`` URL.
+        """
+        chosen = generate_nonce() if nonce is None else nonce
+        if not validate_nonce(chosen):
+            raise SigningError(NONCE_RULE)
+        try:
+            target = replace(request, url=target_uri(request.url))
+        except ValueError as e:
+            raise SigningError(f"the request can't be signed: {e}") from e
+        return _sign(target, self.config, REQUEST, now=now, nonce=chosen)
+
+
+@dataclass(frozen=True, slots=True)
+class ResponseSigner(_Signer):
+    """Signs responses as ``config.origin`` with ``config.key``, bound to their requests.
+
+    It is immutable.
+    """
+
+    def sign(self, response: HTTPResponse, *, now: UnixSeconds | None = None) -> HTTPResponse:
+        """Returns ``response`` signed, bound to ``response.request``.
+
+        ``response.request`` is the request the response answers, with its
+        headers as received. When it carries a ``web-bot-auth`` signature, the
+        response signature covers ``"signature";req;key=<its label>``.
+        Raises :class:`SigningError` for a response the profile can't sign.
+        """
+        return _sign(response, self.config, RESPONSE, now=now, nonce=None)
+
+
+__all__ = [
+    "RequestSigner",
+    "ResponseSigner",
+    "SignerConfig",
+    "generate_nonce",
+]
diff --git a/src/iab_agentic_primitives/web_bot_auth/sync.py b/src/iab_agentic_primitives/web_bot_auth/sync.py
new file mode 100644
index 0000000..973f76f
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/sync.py
@@ -0,0 +1,206 @@
+"""Synchronous code and the async verifiers: one loop, owned by whoever owns the resolver.
+
+The verifiers are async, and a :class:`~.resolver.DirectoryResolver` belongs
+to the event loop it first resolves on: its fetches in flight and its
+client's connection pool live there. :class:`SyncRuntime` is that loop for
+synchronous code. It runs one loop on its own thread for its whole life, and
+every sync call runs there, so the pool is reused across calls instead of
+being stranded on a closed loop.
+
+.. code-block:: python
+
+    resolver = DirectoryResolver()
+    with SyncRuntime(resolver) as runtime:
+        verifier = SyncRequestVerifier(RequestVerifier(resolver, ...), runtime=runtime)
+        verified = verifier.verify(request)
+
+Create one runtime per resolver, where the resolver is created, and pass it
+to every façade and :class:`~.httpx.WebBotAuth` that verifies through that
+resolver. Closing the runtime cancels the calls still running, which raise
+:class:`ConfigurationError`, closes the resolver, and stops the thread.
+
+A sync call made inside a running event loop raises ``RuntimeError``, as
+``asyncio.run`` does, instead of blocking that loop: await the verifier there,
+or :meth:`SyncRuntime.run_async` for a resolver the runtime owns.
+
+A runtime belongs to the process that made it. A forked child inherits the
+runtime but not its thread, so a call there raises :class:`ConfigurationError`
+instead of waiting on a loop nothing runs: a pre-fork server (gunicorn
+``--preload``) creates the runtime, and the resolver, in each worker.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import concurrent.futures
+import os
+import threading
+from collections.abc import Coroutine
+from dataclasses import dataclass
+from types import TracebackType
+from typing import Final, Self, TypeVar
+
+from .errors import ConfigurationError
+from .message import HTTPRequest, HTTPResponse
+from .resolver import DirectoryResolver
+from .roles import RequestConfirmer, ResponseConfirmer
+from .values import UnixSeconds
+from .verifier import SAME_ORIGIN, ExpectedOrigin, VerifiedRequest, VerifiedResponse
+
+T = TypeVar("T")
+
+
+class SyncRuntime:
+    """One event loop on its own thread, run under :class:`asyncio.Runner` until :meth:`close`.
+
+    ``resolver``, when given, is the resolver the runtime owns: it is closed
+    on the runtime's loop when the runtime closes. Use it as a context
+    manager, or call :meth:`close`.
+
+    The runtime belongs to the process that made it: in a forked child, a
+    call raises :class:`ConfigurationError`, and :meth:`close` only marks it
+    closed, leaving the parent's loop, thread, and connections alone.
+    """
+
+    __slots__ = ("_closed", "_loop", "_pid", "_ready", "_resolver", "_stopping", "_thread")
+
+    def __init__(self, resolver: DirectoryResolver | None = None) -> None:
+        self._pid: Final = os.getpid()
+        self._resolver: Final = resolver
+        self._ready: Final = threading.Event()
+        self._loop: asyncio.AbstractEventLoop | None = None
+        self._stopping: asyncio.Event | None = None
+        self._closed = False
+        self._thread: Final = threading.Thread(
+            target=self._main, name="web-bot-auth-sync", daemon=True
+        )
+        self._thread.start()
+        self._ready.wait()
+
+    def _main(self) -> None:
+        with asyncio.Runner() as runner:
+            runner.run(self._serve())
+
+    async def _serve(self) -> None:
+        self._loop = asyncio.get_running_loop()
+        self._stopping = asyncio.Event()
+        self._ready.set()
+        await self._stopping.wait()
+        # The calls still running are cancelled before the resolver closes under them.
+        current = asyncio.current_task()
+        running = [task for task in asyncio.all_tasks() if task is not current]
+        for task in running:
+            task.cancel()
+        await asyncio.gather(*running, return_exceptions=True)
+        if self._resolver is not None:
+            await self._resolver.aclose()
+
+    def _forked(self) -> bool:
+        return os.getpid() != self._pid
+
+    def _submit(self, coroutine: Coroutine[object, object, T]) -> concurrent.futures.Future[T]:
+        if self._forked():
+            coroutine.close()
+            raise ConfigurationError(
+                f"the sync runtime was created in process {self._pid}, before a fork; "
+                "create the runtime and its resolver in the worker"
+            )
+        if self._closed or self._loop is None:
+            coroutine.close()
+            raise ConfigurationError("the sync runtime is closed")
+        return asyncio.run_coroutine_threadsafe(coroutine, self._loop)
+
+    def run(self, coroutine: Coroutine[object, object, T]) -> T:
+        """Runs ``coroutine`` on the runtime's loop and returns its result.
+
+        Raises ``RuntimeError`` inside a running event loop, and
+        :class:`ConfigurationError` when the runtime is closed, closes while
+        the call runs, or was created before a fork.
+        """
+        try:
+            asyncio.get_running_loop()
+        except RuntimeError:
+            pass
+        else:
+            coroutine.close()
+            raise RuntimeError(
+                "a sync verify inside a running event loop would block it; await verify() there"
+            )
+        try:
+            return self._submit(coroutine).result()
+        except concurrent.futures.CancelledError as e:
+            raise ConfigurationError("the sync runtime closed while the call ran") from e
+
+    async def run_async(self, coroutine: Coroutine[object, object, T]) -> T:
+        """Runs ``coroutine`` on the runtime's loop and awaits it from the caller's loop.
+
+        Async code that shares a resolver with synchronous code reaches the
+        resolver this way, on its one loop.
+        """
+        try:
+            return await asyncio.wrap_future(self._submit(coroutine))
+        except asyncio.CancelledError as e:
+            if not self._closed:
+                raise
+            raise ConfigurationError("the sync runtime closed while the call ran") from e
+
+    def close(self) -> None:
+        """Cancels the calls still running, closes the resolver it owns, and stops the thread.
+
+        Closing twice does nothing. In a forked child it only marks the
+        runtime closed: the loop and the resolver's connections are the
+        parent's.
+        """
+        if self._closed:
+            return
+        self._closed = True
+        if self._forked():
+            return
+        if self._loop is not None and self._stopping is not None:
+            self._loop.call_soon_threadsafe(self._stopping.set)
+        self._thread.join()
+
+    def __enter__(self) -> Self:
+        return self
+
+    def __exit__(
+        self,
+        kind: type[BaseException] | None,
+        error: BaseException | None,
+        traceback: TracebackType | None,
+    ) -> None:
+        self.close()
+
+
+@dataclass(frozen=True, slots=True)
+class SyncRequestVerifier:
+    """A :class:`~.roles.RequestConfirmer` for synchronous code, run on ``runtime``."""
+
+    verifier: RequestConfirmer
+    runtime: SyncRuntime
+
+    def verify(self, request: HTTPRequest, *, now: UnixSeconds | None = None) -> VerifiedRequest:
+        """:meth:`RequestVerifier.verify`, run to completion on the runtime's loop."""
+        return self.runtime.run(self.verifier.verify(request, now=now))
+
+
+@dataclass(frozen=True, slots=True)
+class SyncResponseVerifier:
+    """A :class:`~.roles.ResponseConfirmer` for synchronous code, run on ``runtime``."""
+
+    verifier: ResponseConfirmer
+    runtime: SyncRuntime
+
+    def verify(
+        self,
+        response: HTTPResponse,
+        *,
+        expected_origin: ExpectedOrigin = SAME_ORIGIN,
+        now: UnixSeconds | None = None,
+    ) -> VerifiedResponse:
+        """:meth:`ResponseVerifier.verify`, run to completion on the runtime's loop."""
+        coroutine = self.verifier.verify(response, expected_origin=expected_origin, now=now)
+        return self.runtime.run(coroutine)
+
+
+__all__ = ["SyncRequestVerifier", "SyncResponseVerifier", "SyncRuntime"]
diff --git a/src/iab_agentic_primitives/web_bot_auth/testing.py b/src/iab_agentic_primitives/web_bot_auth/testing.py
new file mode 100644
index 0000000..d7b6468
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/testing.py
@@ -0,0 +1,153 @@
+"""Test support: directories served from data, and the contracts of the store ports.
+
+:func:`directory_transport` answers the well-known directory path of each
+origin it is given, and ``404`` to anything else, and :func:`served_resolver`
+is a resolver over it. It streams each body, so a
+fetch through it runs the same bounded read as a fetch over the network.
+
+:func:`check_directory_store` and :func:`check_nonce_store` check a
+:class:`~.ports.DirectoryStore` or a :class:`~.replay.NonceStore` against its
+contract, so a deployment can run them on its own backend, such as Redis. Each
+raises ``AssertionError`` naming the rule a store breaks.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Callable, Mapping
+
+import httpx
+
+from .directory import DirectoryResponse, publish_directory
+from .fetcher import HttpxDirectoryFetcher
+from .keys import Ed25519Key
+from .message import Answer, HeaderLines
+from .ports import DirectoryStore
+from .replay import NonceStore
+from .resolver import DirectoryResolver
+from .values import Clock, Origin, Seconds, UnixSeconds, system_clock
+
+_NOT_FOUND = Answer(404, HeaderLines(), b"")
+
+
+def directory_transport(responses: Mapping[Origin, Answer]) -> httpx.MockTransport:
+    """Returns an httpx transport that serves directory responses from data.
+
+    ``responses`` maps an origin to the :class:`~.message.Answer` its
+    directory URL serves. Any other URL gets ``404``. Use it with
+    ``HttpxDirectoryFetcher(transport=directory_transport(...))``.
+    """
+    served = {origin.directory_url: answer for origin, answer in responses.items()}
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        url = f"{request.url.scheme}://{request.url.netloc.decode()}{request.url.path}"
+        answer = served.get(url, _NOT_FOUND)
+        return httpx.Response(
+            answer.status, headers=answer.headers.items(), stream=httpx.ByteStream(answer.body)
+        )
+
+    return httpx.MockTransport(handler)
+
+
+def served_resolver(
+    directories: Mapping[Origin, Answer], *, clock: Clock = system_clock
+) -> DirectoryResolver:
+    """A resolver that fetches each origin's directory from ``directories``, with no network.
+
+    The fetch runs the same bounded read as one over the network. ``clock`` is
+    the resolver's own: it stamps each fetch, and the directory is verified
+    at that time.
+    """
+    fetcher = HttpxDirectoryFetcher(transport=directory_transport(directories))
+    return DirectoryResolver(fetcher, clock=clock)
+
+
+# ── the store contracts ───────────────────────────────────────────────────
+
+#: The instant the contracts' directories are fetched at: 2026-11-07T12:00:00Z.
+_AT = UnixSeconds(1794052800)
+
+
+def _directory(host: str, key: Ed25519Key) -> tuple[Origin, DirectoryResponse]:
+    """``https://<host>`` and a real signed directory response of it, fetched at :data:`_AT`."""
+    origin = Origin(host)
+    published = publish_directory(origin, [key], now=_AT)
+    fetched = DirectoryResponse(
+        origin.directory_url, published.status, published.headers, published.body, _AT
+    )
+    return origin, fetched
+
+
+def _require(holds: bool, rule: str) -> None:
+    """Raises ``AssertionError`` naming ``rule`` when it doesn't hold, under ``-O`` too."""
+    if not holds:
+        raise AssertionError(f"the store breaks its contract: {rule}")
+
+
+def _same(got: DirectoryResponse | None, want: DirectoryResponse, rule: str) -> None:
+    """``got`` is ``want``: the same URL, status, field lines, body bytes, and fetch time."""
+    _require(got is not None, f"{rule} (get returned nothing)")
+    if got is not None:
+        found = (got.url, got.status, got.headers.items(), got.body, got.fetched_at)
+        expected = (want.url, want.status, want.headers.items(), want.body, want.fetched_at)
+        _require(found == expected, rule)
+
+
+async def check_directory_store(make: Callable[[], DirectoryStore]) -> None:
+    """Checks the stores ``make`` returns, each empty, against the DirectoryStore contract.
+
+    A store keeps each directory response under its origin, in either order
+    of puts, replaces only that origin's, gives back the exact bytes and
+    fetch time it was given, and keeps each origin's failure deadline apart
+    from the others'.
+    """
+    key = Ed25519Key.generate()
+    a, b = _directory("a.store-check.example", key), _directory("b.store-check.example", key)
+    for first, second in ((a, b), (b, a)):
+        store = make()
+        _require(await store.get(first[0]) is None, "an empty store holds nothing")
+        await store.put(*first)
+        await store.put(*second)
+        _same(await store.get(first[0]), first[1], "a put keeps other origins' directories")
+        _same(await store.get(second[0]), second[1], "a put keeps its origin's directory")
+    store = make()
+    await store.put(*a)
+    await store.put(*b)
+    again = _directory("a.store-check.example", Ed25519Key.generate())
+    await store.put(*again)
+    _same(await store.get(a[0]), again[1], "a put replaces its origin's directory")
+    _same(await store.get(b[0]), b[1], "a put replaces no other origin's directory")
+    until = UnixSeconds(_AT + 60)
+    await store.record_failure(a[0], until)
+    _require(await store.failure_until(a[0]) == until, "a failure deadline is kept")
+    _require(await store.failure_until(b[0]) is None, "a failure is its origin's alone")
+    await store.record_failure(a[0], UnixSeconds(until + 60))
+    _require(await store.failure_until(a[0]) == until + 60, "a later failure replaces one")
+
+
+async def check_nonce_store(make: Callable[[Clock], NonceStore]) -> None:
+    """Checks the stores ``make`` returns for a clock against the NonceStore contract.
+
+    A store records each ``(origin, nonce)`` pair once, apart for each origin,
+    and keeps it for its ``ttl``.
+    """
+    now = [_AT]
+    store = make(lambda: now[0])
+    a, b = Origin("a.store-check.example"), Origin("b.store-check.example")
+
+    async def record(origin: Origin, nonce: str) -> bool:
+        return await store.check_and_record(origin, nonce, Seconds(60))
+
+    _require(await record(a, "n1"), "a new pair is recorded")
+    _require(not await record(a, "n1"), "a recorded pair is refused")
+    _require(await record(b, "n1"), "a nonce is recorded per origin")
+    _require(await record(a, "n2"), "another nonce is a new pair")
+    now[0] = UnixSeconds(_AT + 60)
+    _require(not await record(a, "n1"), "a pair is kept for its ttl")
+
+
+__all__ = [
+    "check_directory_store",
+    "check_nonce_store",
+    "directory_transport",
+    "served_resolver",
+]
diff --git a/src/iab_agentic_primitives/web_bot_auth/values.py b/src/iab_agentic_primitives/web_bot_auth/values.py
new file mode 100644
index 0000000..fe882b1
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/values.py
@@ -0,0 +1,567 @@
+"""The profile's values: identities, key ids, time, and where a directory lives. No I/O.
+
+An identity is an :class:`Origin`, ``https://<host>``: a canonical host
+(IDNA-2008 A-labels in lowercase, or an IP literal) with no port, path, query,
+fragment, or userinfo. Only two constructors make one, so holding an
+:class:`Origin` means the value was checked:
+
+- :meth:`Origin.parse` reads configuration and raises
+  :class:`ConfigurationError`.
+- :meth:`Origin.from_signature_agent` reads a ``Signature-Agent`` member and
+  raises a refusal.
+
+A server's own identity is a :class:`ServerIdentity`, built once from
+configuration, which checks itself when it is made.
+
+Time is :data:`UnixSeconds`, an instant in whole seconds, converted once, at
+the clock; a duration is :data:`Seconds`. :func:`whole_number` and
+:func:`identifier_set` check configuration values, and raise
+:class:`ConfigurationError`, for every configuration type in the module.
+"""
+
+from __future__ import annotations
+
+import base64
+import enum
+import ipaddress
+import re
+import time
+from collections.abc import Callable, Collection
+from dataclasses import dataclass
+from typing import Final, NewType
+from urllib.parse import urlsplit
+
+import idna
+
+from .errors import ConfigurationError, Refusal, refuse
+
+#: The well-known path of a key directory.
+DIRECTORY_PATH = "/.well-known/http-message-signatures-directory"
+#: The media type of a key directory.
+DIRECTORY_MEDIA_TYPE = "application/http-message-signatures-directory+json"
+
+#: A point in time, in whole Unix seconds.
+UnixSeconds = NewType("UnixSeconds", int)
+#: A duration, in whole seconds.
+Seconds = NewType("Seconds", int)
+#: A clock returns the current time in Unix seconds.
+Clock = Callable[[], UnixSeconds]
+
+#: A key id: the RFC 7638 thumbprint of an Ed25519 public JWK.
+KeyId = NewType("KeyId", str)
+#: The authority of an identity: its host. Its directory is fetched on port 443.
+Authority = NewType("Authority", str)
+#: The ``@authority`` of a request URL, as RFC 9421 computes it: a lowercase
+#: host and a port other than the scheme's default.
+RequestAuthority = NewType("RequestAuthority", str)
+
+
+class Omit(enum.Enum):
+    """The one value that leaves a signature parameter or field out."""
+
+    OMIT = "omit"
+
+
+#: Leaves a signature parameter, or a field the signer would add, out.
+OMIT: Final = Omit.OMIT
+
+_SCHEME = "https://"
+_DEFAULT_PORTS = {"http": 80, "https": 443}
+
+
+def system_clock() -> UnixSeconds:
+    """The system time in whole Unix seconds."""
+    return UnixSeconds(int(time.time()))
+
+
+def is_decimal(value: str) -> bool:
+    """True for ASCII decimal digits only, which ``int`` reads as written."""
+    return value.isascii() and value.isdecimal()
+
+
+def whole_number(name: str, value: object, *, minimum: int, maximum: int | None = None) -> int:
+    """``value`` when it is a whole number from ``minimum`` to ``maximum``.
+
+    A ``bool`` isn't one. Anything else raises :class:`ConfigurationError`.
+    """
+    if isinstance(value, bool) or not isinstance(value, int):
+        raise ConfigurationError(f"{name} is a whole number, not {value!r}")
+    if value < minimum or (maximum is not None and value > maximum):
+        upper = "" if maximum is None else f" and at most {maximum}"
+        raise ConfigurationError(f"{name} is at least {minimum}{upper}, not {value}")
+    return value
+
+
+def identifier_set(name: str, values: object) -> frozenset[str]:
+    """``values`` as a set of strings; anything else, a bare string included, is refused.
+
+    Raises :class:`ConfigurationError`.
+    """
+    if isinstance(values, (str, bytes)) or not isinstance(values, Collection):
+        raise ConfigurationError(f"{name} is a collection of strings, not {values!r}")
+    items = frozenset(values)
+    if not all(isinstance(v, str) for v in items):
+        raise ConfigurationError(f"{name} holds only strings, not {sorted(map(repr, items))}")
+    return frozenset(str(v) for v in items)
+
+
+def is_canonical_host(host: str) -> bool:
+    """True when ``host`` is already in canonical form, with no port.
+
+    A name is canonical when IDNA-2008 (UTS #46, non-transitional) encodes it to
+    itself: lowercase ASCII A-labels, no trailing dot, and a last label that
+    isn't a number. An IPv4 address in dotted-decimal form, or an IPv6 address
+    in brackets with no zone, is canonical in its compressed form.
+    """
+    if not host or host.endswith(".") or "%" in host:
+        return False
+    literal = host[1:-1] if host.startswith("[") and host.endswith("]") else host
+    try:
+        ip = ipaddress.ip_address(literal)
+    except ValueError:
+        pass
+    else:
+        expected = f"[{ip}]" if ip.version == 6 else str(ip)
+        return host == expected
+    # A name whose last label is a number reads as an IPv4 address to a URL parser
+    # (WHATWG "ends in a number"): 127.1, 2130706433, 1.2.3.04, 0x7f.0.0.1.
+    last = host.rsplit(".", 1)[-1]
+    if last.isdigit() or last[:2].lower() == "0x":
+        return False
+    try:
+        return idna.encode(host, uts46=True, transitional=False).decode("ascii") == host
+    except (idna.IDNAError, UnicodeError):
+        return False
+
+
+def _canonical_host(host: str) -> str:
+    """``host``, as ``urlsplit`` reads it, in the canonical form :func:`is_canonical_host` checks.
+
+    A name that IDNA-2008 can't encode is returned as given, for the caller's
+    check to refuse.
+    """
+    try:
+        ip = ipaddress.ip_address(host)
+    except ValueError:
+        pass
+    else:
+        return f"[{ip}]" if ip.version == 6 else str(ip)
+    try:
+        return idna.encode(host, uts46=True, transitional=False).decode("ascii")
+    except (idna.IDNAError, UnicodeError):
+        return host
+
+
+def _split(value: object) -> tuple[str, str] | None:
+    """Returns ``(host, rest)`` for ``https://<host><rest>`` with a canonical host, or ``None``."""
+    if not isinstance(value, str) or not value.isascii() or not value.startswith(_SCHEME):
+        return None
+    host, slash, path = value[len(_SCHEME) :].partition("/")
+    if not is_canonical_host(host):
+        return None
+    return host, slash + path
+
+
+@dataclass(frozen=True, slots=True, order=True)
+class Origin:
+    """An identity origin, ``https://<host>``. ``str(origin)`` is its serialization."""
+
+    host: str
+
+    def __post_init__(self) -> None:
+        if not isinstance(self.host, str) or not is_canonical_host(self.host):
+            raise ConfigurationError(f"{self.host!r} is not a canonical host")
+
+    @classmethod
+    def parse(cls, value: object) -> Origin:
+        """Reads an origin from configuration: exactly ``https://<host>``.
+
+        Raises :class:`ConfigurationError` for anything else: ``http``, a port
+        (``:443`` included), an uppercase host, a trailing ``/``, or a path,
+        query, fragment, or userinfo.
+        """
+        split = _split(value)
+        if split is None or split[1] != "":
+            raise ConfigurationError(f"{value!r} is not an origin https://<host>")
+        return cls(split[0])
+
+    @classmethod
+    def from_signature_agent(cls, value: object) -> Origin:
+        """Reads the origin a ``Signature-Agent`` member value names.
+
+        The value is exactly ``https://<host>/.well-known/http-message-signatures-directory``
+        or exactly ``https://<host>``, with a lowercase host and no port. The
+        first is the key directory URL that draft -01 fetches directly; the
+        second is the draft -00 form, which resolves to the same URL. The value
+        is compared with those two strings, never normalized. Raises
+        :class:`WebBotAuthError` (``signature-agent-value``) for anything else.
+        """
+        split = _split(value)
+        if split is None or split[1] not in ("", DIRECTORY_PATH):
+            raise refuse(
+                Refusal.SIGNATURE_AGENT_VALUE,
+                f"Signature-Agent {value!r} is not https://<host>{DIRECTORY_PATH} or https://<host>",
+            )
+        return cls(split[0])
+
+    @classmethod
+    def of_url(cls, url: str) -> Origin:
+        """The identity of the host ``url`` names, ``https://<host>``, whatever its scheme and port.
+
+        This is the one mapping from a URL host to an identity. A name is
+        mapped through IDNA-2008 (UTS #46, non-transitional), the
+        canonicalization :func:`is_canonical_host` checks, so
+        ``https://Bücher.example:8443/x`` names ``https://xn--bcher-kva.example``.
+        An IP address is written in its compressed form. Raises
+        :class:`ConfigurationError` when the URL has no host, or its host
+        can't be an identity, such as one with a trailing dot.
+        """
+        try:
+            host = urlsplit(url).hostname if isinstance(url, str) else None
+        except ValueError as e:
+            raise ConfigurationError(f"{url!r} is not a URL: {e}") from e
+        if not host:
+            raise ConfigurationError(f"{url!r} names no host")
+        return cls(_canonical_host(host))
+
+    @property
+    def authority(self) -> Authority:
+        """The ``@authority`` of the origin's URLs: its host."""
+        return Authority(self.host)
+
+    @property
+    def directory_url(self) -> str:
+        """The key directory URL, the value a signer sends in ``Signature-Agent``."""
+        return f"{self}{DIRECTORY_PATH}"
+
+    def __str__(self) -> str:
+        return f"{_SCHEME}{self.host}"
+
+
+def _url_authority(scheme: str, host: str, port: int | None) -> RequestAuthority:
+    if ":" in host:
+        host = f"[{host}]"
+    if port is None or port == _DEFAULT_PORTS.get(scheme):
+        return RequestAuthority(host)
+    return RequestAuthority(f"{host}:{port}")
+
+
+# ── the target URI: the one URL rule ──────────────────────────────────────
+
+#: What a URL parser trims from both ends of a URL: C0 controls and space (WHATWG).
+_TRIMMED = "".join(map(chr, range(0x21)))
+#: What a URL parser removes from anywhere in a URL: tab and newline (WHATWG).
+_REMOVED = str.maketrans("", "", "\t\n\r")
+#: The printable ASCII characters a path carries percent-encoded on the wire: the
+#: WHATWG path percent-encode set. Controls, DEL, and non-ASCII are always encoded.
+_PATH_ENCODED = frozenset(' "#<>?`{}')
+#: The printable ASCII characters an http(s) query carries percent-encoded on the
+#: wire: the WHATWG special-query percent-encode set.
+_QUERY_ENCODED = frozenset(" \"#<>'")
+#: The path segments a URL parser reads as ``.`` and ``..`` (WHATWG), lowercased.
+_SINGLE_DOT = frozenset({".", "%2e"})
+_DOUBLE_DOT = frozenset({"..", ".%2e", "%2e.", "%2e%2e"})
+_SCHEME_PREFIX = re.compile(r"([A-Za-z][A-Za-z0-9+.\-]*)://")
+
+
+def _percent_encoded(text: str, encoded: frozenset[str]) -> str:
+    """``text`` with ``encoded``, controls, DEL, and non-ASCII percent-encoded as UTF-8.
+
+    An existing escape, ``%zz`` included, is left as it is.
+    """
+    out: list[str] = []
+    for c in text:
+        if " " < c < "\x7f" and c not in encoded:
+            out.append(c)
+        else:
+            out.extend(f"%{b:02X}" for b in c.encode("utf-8", "surrogatepass"))
+    return "".join(out)
+
+
+def _without_dot_segments(path: str) -> str:
+    """``path``, which starts with ``/``, with its dot segments removed (RFC 3986 § 5.2.4).
+
+    A segment is a dot segment as WHATWG reads it, ``%2e`` included, and a
+    trailing one leaves the path ending in ``/``.
+    """
+    segments = path.split("/")[1:]
+    kept: list[str] = []
+    for i, segment in enumerate(segments):
+        last = i == len(segments) - 1
+        lowered = segment.lower()
+        if lowered in _DOUBLE_DOT:
+            if kept:
+                kept.pop()
+        elif lowered not in _SINGLE_DOT:
+            kept.append(segment)
+            continue
+        if last:
+            kept.append("")
+    return "/" + "/".join(kept)
+
+
+def _host_and_port(authority: str) -> tuple[str, str]:
+    """``host[:port]`` split, after any userinfo, with an IPv6 literal kept in brackets."""
+    hostport = authority.rpartition("@")[2]
+    if hostport.startswith("["):
+        literal, bracket, after = hostport.partition("]")
+        if not bracket or (after and not after.startswith(":")):
+            raise ValueError(f"{authority!r} is not a host and port")
+        return literal + bracket, after[1:]
+    host, _, port = hostport.partition(":")
+    return host, port
+
+
+def _target_host(host: str) -> str:
+    """``host`` as the wire carries it: an IP literal compressed, a name lowercased in A-labels."""
+    if host.startswith("["):
+        try:
+            return f"[{ipaddress.IPv6Address(host[1:-1])}]"
+        except ValueError as e:
+            raise ValueError(f"{host!r} is not an IPv6 address") from e
+    if not host:
+        raise ValueError("the URL names no host")
+    return _canonical_host(host).lower()
+
+
+def _target_port(port: str, scheme: str) -> int | None:
+    """No port for none, an empty one, or the scheme's default; ``ValueError`` for a bad one."""
+    if not port:
+        return None
+    if not is_decimal(port) or int(port) > 65535:
+        raise ValueError(f"{port!r} is not a port")
+    number = int(port)
+    return None if number == _DEFAULT_PORTS[scheme] else number
+
+
+@dataclass(frozen=True, slots=True)
+class TargetURI:
+    """A request's target URI as it travels on the wire: the profile's one URL rule.
+
+    The signer signs this value as ``@target-uri``, the verifier checks it, the
+    server edge rebuilds it, and ``@authority`` is its :attr:`authority`, so a
+    URL a signer signs is the URL a verifier recomputes. It is the URL an HTTP
+    client sends, the WHATWG URL serialization that httpx and ``fetch``
+    produce, normalized per RFC 3986 § 6.2.2:
+
+    - the scheme and host are lowercase, a name in IDNA A-labels and an IP
+      literal in compressed form, and a default port is dropped;
+    - dot segments are removed, and an empty path is ``/``;
+    - the characters WHATWG percent-encodes are percent-encoded: controls,
+      space, non-ASCII (as UTF-8), ``" < >`` and, in the path, ``` ` { } ```
+      or, in the query, ``'``. Everything else, such as ``| ^ [ ] { }`` in a
+      query, stays as written, and an existing escape is never changed;
+    - userinfo and the fragment, which never go on the wire, are dropped, and
+      so is an empty query: a server can't tell ``/p?`` from ``/p``.
+
+    ``str()`` is the serialization. :meth:`parse` is the one way to make one.
+    """
+
+    scheme: str
+    host: str
+    port: int | None
+    path: str
+    query: str | None
+
+    @classmethod
+    def parse(cls, url: str) -> TargetURI:
+        """Reads an absolute ``http`` or ``https`` URL; ``ValueError`` for anything else."""
+        if not isinstance(url, str):
+            raise ValueError(f"a URL is a str, not {url!r}")
+        text = url.strip(_TRIMMED).translate(_REMOVED).partition("#")[0]
+        prefix = _SCHEME_PREFIX.match(text)
+        scheme = prefix[1].lower() if prefix else ""
+        if prefix is None or scheme not in _DEFAULT_PORTS:
+            raise ValueError(f"{url!r} is not an absolute http or https URL")
+        before, _, query = text[prefix.end() :].partition("?")
+        authority, slash, path = before.replace("\\", "/").partition("/")
+        host, port = _host_and_port(authority)
+        return cls(
+            scheme,
+            _target_host(host),
+            _target_port(port, scheme),
+            _percent_encoded(_without_dot_segments(slash + path or "/"), _PATH_ENCODED),
+            _percent_encoded(query, _QUERY_ENCODED) or None,
+        )
+
+    @property
+    def authority(self) -> RequestAuthority:
+        """The ``@authority`` (RFC 9421 § 2.2.3): the host, and a port other than the default."""
+        return RequestAuthority(self.host if self.port is None else f"{self.host}:{self.port}")
+
+    def __str__(self) -> str:
+        query = "" if self.query is None else f"?{self.query}"
+        return f"{self.scheme}://{self.authority}{self.path}{query}"
+
+
+def authority_of(url: str) -> RequestAuthority:
+    """Returns the ``@authority`` of an absolute URL (RFC 9421 section 2.2.3).
+
+    It is :attr:`TargetURI.authority`, under the same URL rule as
+    ``@target-uri``: the host is lowercased and a default port dropped.
+    Raises ``ValueError`` for anything but an absolute ``http`` or ``https``
+    URL.
+    """
+    return TargetURI.parse(url).authority
+
+
+#: A host with an optional port: no path, userinfo, or space.
+_AUTHORITY = re.compile(r"[^/@\s]+")
+
+
+def parse_authority(value: object) -> RequestAuthority:
+    """Reads a request authority from configuration, such as ``seller.example.com:8443``.
+
+    The value is normalized as ``@authority`` is computed: a lowercase host and
+    no default port. Raises :class:`ConfigurationError` for anything else.
+    """
+    if not isinstance(value, str) or _AUTHORITY.fullmatch(value) is None:
+        raise ConfigurationError(f"an authority is a host with an optional port, not {value!r}")
+    try:
+        return authority_of(f"https://{value}")
+    except ValueError as e:
+        raise ConfigurationError(f"{value!r} is not an authority: {e}") from e
+
+
+def key_id_set(values: object) -> frozenset[KeyId]:
+    """Returns ``values`` as a set of key ids; :class:`ConfigurationError` for anything else."""
+    return frozenset(KeyId(v) for v in identifier_set("the key ids", values))
+
+
+#: A base URL: ``http`` or ``https``, an authority, and nothing after it.
+_BASE_URL = re.compile(r"(?P<scheme>https?)://(?P<netloc>[^/?#@\s]+)")
+
+
+@dataclass(frozen=True, slots=True)
+class _BaseURL:
+    """A base URL split into its scheme, canonical host, and port."""
+
+    scheme: str
+    host: str
+    port: int | None
+
+    @property
+    def authority(self) -> RequestAuthority:
+        return _url_authority(self.scheme, self.host, self.port)
+
+
+def _netloc_parts(netloc: str) -> tuple[str, str]:
+    if netloc.endswith("]") or ":" not in netloc:
+        return netloc, ""
+    host, _, port = netloc.rpartition(":")
+    return host, port
+
+
+def _decimal_port(port: str) -> int:
+    """A port in canonical decimal, from 1 to 65535; :class:`ConfigurationError` else."""
+    if is_decimal(port) and not port.startswith("0") and int(port) < 65536:
+        return int(port)
+    raise ConfigurationError(f"{port!r} is not a port")
+
+
+def _port(port: str, scheme: str) -> int | None:
+    """No port, or one other than the scheme's default."""
+    if not port:
+        return None
+    number = _decimal_port(port)
+    if number == _DEFAULT_PORTS[scheme]:
+        raise ConfigurationError(f"a base URL names no default port, not :{port}")
+    return number
+
+
+def _base_url_match(value: object) -> re.Match[str]:
+    match = _BASE_URL.fullmatch(value) if isinstance(value, str) else None
+    if match is None:
+        raise ConfigurationError(
+            f"base_url must be an origin such as https://seller.example.com, not {value!r}"
+        )
+    return match
+
+
+def _base_url(value: object) -> _BaseURL:
+    """Reads ``scheme://host[:port]`` with a canonical host; :class:`ConfigurationError` else."""
+    match = _base_url_match(value)
+    host, port = _netloc_parts(match["netloc"])
+    if not is_canonical_host(host):
+        raise ConfigurationError(f"base_url {value!r} needs a canonical host")
+    return _BaseURL(match["scheme"], host.strip("[]"), _port(port, match["scheme"]))
+
+
+@dataclass(frozen=True, slots=True)
+class ServerIdentity:
+    """A server's own identity, from configuration, never from a request.
+
+    ``origin`` is the identity it signs as, ``https://<host>``. ``base_url`` is
+    the scheme and authority of its public URLs, such as
+    ``https://seller.example.com:8443``: the middlewares rebuild each request
+    URL on it, whatever ``Host`` the client sends, and the request verifier
+    accepts a URL for its authority, :attr:`request_authority`, alone. One
+    fact sets both, so a request the edges rebuild is always one the verifier
+    can accept.
+
+    It checks itself when it is made: ``base_url`` has the origin's host.
+    Anything else raises :class:`ConfigurationError`. :meth:`from_config`
+    builds one from a string.
+    """
+
+    origin: Origin
+    base_url: str
+
+    def __post_init__(self) -> None:
+        if not isinstance(self.origin, Origin):
+            raise ConfigurationError(f"origin is an Origin, not {self.origin!r}")
+        base = _base_url(self.base_url)
+        if base.host != self.origin.host.strip("[]"):
+            raise ConfigurationError(f"base_url {self.base_url} isn't on {self.origin}")
+
+    @property
+    def request_authority(self) -> RequestAuthority:
+        """The ``@authority`` of the server's own URLs, from ``base_url``."""
+        return _base_url(self.base_url).authority
+
+    @classmethod
+    def from_config(cls, base_url: str) -> ServerIdentity:
+        """Builds the identity of the server whose public base URL is ``base_url``.
+
+        ``base_url`` is ``https://<host>`` or ``http://<host>``, with a
+        canonical host, an optional port other than the scheme's default, and
+        an optional trailing ``/``. The identity origin is always
+        ``https://<host>``. Raises :class:`ConfigurationError` for anything else.
+        """
+        value = base_url.removesuffix("/") if isinstance(base_url, str) else base_url
+        base = _base_url(value)
+        origin = Origin(f"[{base.host}]" if ":" in base.host else base.host)
+        return cls(origin, str(value))
+
+
+def b64url_decode(value: str) -> bytes:
+    """Decodes unpadded or padded base64url."""
+    return base64.urlsafe_b64decode(value + "=" * (-len(value) % 4))
+
+
+def b64url_encode(data: bytes) -> str:
+    """Encodes ``data`` as unpadded base64url."""
+    return base64.urlsafe_b64encode(data).rstrip(b"=").decode()
+
+
+__all__ = [
+    "DIRECTORY_MEDIA_TYPE",
+    "DIRECTORY_PATH",
+    "OMIT",
+    "Authority",
+    "Clock",
+    "KeyId",
+    "Omit",
+    "Origin",
+    "RequestAuthority",
+    "Seconds",
+    "ServerIdentity",
+    "TargetURI",
+    "UnixSeconds",
+    "authority_of",
+    "identifier_set",
+    "is_canonical_host",
+    "is_decimal",
+    "system_clock",
+    "whole_number",
+]
diff --git a/src/iab_agentic_primitives/web_bot_auth/vectors/README.md b/src/iab_agentic_primitives/web_bot_auth/vectors/README.md
new file mode 100644
index 0000000..059c7d9
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/vectors/README.md
@@ -0,0 +1,181 @@
+# Web Bot Auth profile conformance vectors
+
+These vectors grade an implementation of the Web Bot Auth (WBA) profile that
+OpenProposal 3.0 § 2.8 defines and `WEB_BOT_AUTH.md` describes. A signer written
+with one WBA or RFC 9421 library and a verifier written with another use them to
+agree on the wire format and on what a verifier refuses. The profile follows
+[draft-ietf-webbotauth-httpsig-protocol-01](https://datatracker.ietf.org/doc/draft-ietf-webbotauth-httpsig-protocol/01/),
+and "WBA section" numbers in the vectors refer to that draft unless a basis
+names -00 or an RFC. Cloudflare's `web-bot-auth` 0.2.0, which the interop
+harness runs, implements -00; the sections the vectors cite have the same
+numbers in both drafts.
+
+## Test keys are public
+
+`keys.json` publishes the private seed of every test key in
+`_private_d_for_test_only`, so you can reproduce every signature. Each seed is
+SHA-256 of the ASCII string `aamp-wba-test/<seed_name>`, used as the Ed25519
+private key. Each `kid` is the key's JWK thumbprint (RFC 7638; RFC 8037
+Appendix A.3 for Ed25519), and each entry's `identity` is the origin whose key
+directory publishes the key.
+
+**These keys are valid only for grading against this suite.** WBA section 6.8
+says test keys "MUST NOT be used in production", and verifiers SHOULD reject
+them when detected. This library's `RequestVerifier` and `ResponseVerifier`
+always refuse them (`rules.TEST_KEY_IDS`), unless a conformance run makes them
+with `keys=CONFORMANCE_KEYS`.
+
+The origins `https://buyer.example.com`, `https://seller.example.com`, and
+`https://other.example.com` are placeholders. A harness serves each directory from
+the vector's `directories` object instead of fetching it.
+
+## Scope
+
+Signers name their key directory URL,
+`https://<host>/.well-known/http-message-signatures-directory`, in
+`Signature-Agent`; `positive/004` shows the bare-origin form a draft -00 signer
+sends, which names the same origin. The vectors exercise the profile's rules:
+the `Signature-Agent` value, the covered `Signature-Agent` member,
+key selection by thumbprint from the directory the member names, the required
+nonce, replay refusal, one signature per request, the signed directory response,
+the signed response and its binding to the request, the verifier's own
+authority, the target URI, and the `400`, `403`, and `429` responses, each with its rule. They don't exercise live directory fetches, the fetch rules, or
+caching; the unit tests in `tests/web_bot_auth/` grade those.
+
+## File layout
+
+```
+vectors/
+├── README.md                                   this file
+├── keys.json                                   three Ed25519 test keys, one per identity, with private seeds
+├── scenarios.json                              scenarios as data, signed by a harness at run time
+├── refusals.json                               the refusal vocabulary: every rule and its status
+├── positive/                                   messages that MUST verify
+│   ├── 001-single-signer-request.json          the buyer commits to proposal prop_7
+│   ├── 002-signed-directory-response.json      the buyer's directory, signed per key (WBA Appendix B.1)
+│   ├── 003-signed-response.json                the seller's CommitResult, bound to positive/001
+│   ├── 004-origin-form-request.json            the same commit, Signature-Agent in the draft -00 origin form
+│   └── 005- to 012-target-uri-*.json           a GET to each URL whose @target-uri the profile normalizes or
+│                                               keeps as sent: ids[]=1, a|b, {json}, a^b, %20, :443, mixed case,
+│                                               and dot segments
+└── negative/                                   messages a verifier MUST refuse, with the status and rule
+    ├── 001-missing-nonce.json                  → 403 nonce-missing
+    ├── 002-replayed-nonce.json                 → 429 nonce-replayed (after verifying positive/001)
+    ├── 003-signature-agent-not-covered.json    → 403 signature-agent-not-covered
+    ├── 004-key-not-in-named-directory.json     → 403 key-not-found (another origin publishes the key)
+    ├── 005-malformed-signature-agent.json      → 400 parse
+    ├── 006-two-signatures.json                 → 403 multiple-signatures (each valid on its own)
+    ├── 007-response-not-bound.json             → 403 response-not-bound
+    └── 008-key-not-in-named-directory-warm-cache.json
+                                                → 403 key-not-found (negative/004, warm cache)
+```
+
+## Vector format
+
+`iab_agentic_primitives.web_bot_auth.conformance.models` types every file, and
+the files validate strictly when they are read: a member nobody declared, a
+string where a boolean belongs, or a float where an integer belongs is refused.
+
+- **`name`**: a one-line description.
+- **`tier`**: `wba` when the reference libraries with no profile rules already
+  give the expected outcome; `profile` when only the profile's rules do.
+- **`spec`** and **`spec_reference`**: the specification, and the URL of the
+  rule's heading in `WEB_BOT_AUTH.md`.
+- **`signing_profile`**: always `web-bot-auth`.
+- **`reference_now`**: Unix seconds, the verifier's clock.
+- **`operation`**: the one operation that grades the vector, ready to send to
+  an adapter as it is (`conformance/PROTOCOL.md`): `verify_request`,
+  `verify_response`, or `verify_directory`. It carries the message, the
+  verifier's clock (`now`, the same as `reference_now`), the authority or
+  origin the verifier holds the message to, and each directory the message's
+  keys come from, signed at `reference_now`; an origin absent from
+  `directories` serves none. A `verify_request` may list `prior` requests: a
+  black-box runner verifies each of them first, with the same directories and
+  clock. Reset verifier state before every vector.
+
+  A message's `headers` is an array of `[name, value]` pairs, one per field
+  line, in wire order; names are case-insensitive. Its `body` is the exact
+  bytes on the wire: a string of UTF-8 text, or `{"base64": ...}` when the
+  bytes aren't UTF-8. Binary header values use RFC 8941 `sf-binary` (standard
+  Base64 with padding).
+- **`replay_cache_entries`**: the replay state the `prior` requests leave, as
+  `{ identity, nonce, ttl_seconds }`, for a white-box harness.
+- **`expected_signature_base`**: keyed by label, the signature base per RFC 9421
+  section 2.5, lines joined with `\n` and no trailing newline. Diff your
+  computed base against it before you look at signatures.
+- **`expected`**: `ok`, a JSON boolean; for a pass, the `identity` the message
+  is attributed to (none for a directory); for a refusal, `status` and `rule`,
+  a rule of `refusals.json` and its status, a JSON integer, and, for a `403` or `429`,
+  `accept_signature`, the `Accept-Signature` member a verifier SHOULD send
+  (conformance grades the status and the rule, not this field). `rationale`
+  says why.
+- **`$comment`**: free-form notes, including which non-conformant verifier
+  behavior the vector catches.
+
+### Scenarios
+
+`scenarios.json` holds scenarios as data instead of signed messages. A harness
+signs each one at run time, so no committed signature expires.
+
+- **`verifier`**: the verifier's own authority, which a request scenario's
+  `authority` replaces.
+- **`signer`** and **`responder`**: the identity, `kid`, and default
+  `Signature-Agent` value (the key directory URL) that sign request scenarios
+  and response scenarios.
+- **`requests`**, **`components`**, **`parameters`**: the base requests (`post`
+  and `get`), their default components, and the default signature parameters.
+  `{label}` stands for the signature's label. `created` and `expires` are
+  offsets in seconds from the harness clock. A `nonce` object asks for that many
+  random bytes in that encoding: `base64url` (unpadded), `base64` (padded), or
+  `base64url-padded`.
+- **`request_scenarios`**: each overrides `base` (`post` by default), `label`,
+  `components`, `parameters` (`null` omits one), `signature_agent`, or
+  `authority`. `extra_signature` adds a second
+  signature. `after_signing` changes `headers`, appends `append_to_body`, or
+  appends raw `append_members` to `Signature-Input` and `Signature`.
+  `directories` lists the `kid` values each origin serves.
+- **`directory_parameters`** and **`directory_max_age`**: what every directory
+  signature carries unless a scenario moves it (`created` and `expires`
+  offsets), and the directory's `Cache-Control` `max-age`.
+- **`directory_scenarios`**: each overrides how the signer's directory is
+  signed: `keys`, `unsigned_keys`, `authority`, `parameters`, `components`,
+  `content_type`, and `after_signing` (`append_to_body`). A refused directory is a `403` with a
+  `directory-*` rule, the refusal the request that needed its key gets.
+- **`response`**, **`response_components`**, **`response_parameters`**,
+  **`response_scenarios`**: the base response (a `CommitResult`), its components
+  with (`bound`) and without (`unbound`) the request binding, and scenarios that
+  override `components`, `parameters`, `request` (`bound`, the default, signs
+  the request; `unbound` sends it unsigned), or `after_signing` (`status`,
+  `append_to_body`, `request_headers`).
+- **`target_uris`**: each is a `GET` to `url`, as a caller writes it, and
+  `wire`, its `@target-uri`: the URL as it travels on the wire
+  (`WEB_BOT_AUTH.md`, "The target URI"). Each side signs the `GET` and the
+  other verifies it as the signer's identity.
+- **`expected`**, **`tier`**, **`basis`**: `expected` as for vectors, `tier`
+  as for vectors (`wba` by default), and `basis`, the rule's source.
+
+## Conformance
+
+An implementation conforms when every positive vector verifies with the
+expected identity, every negative vector gets its status and rule, and every
+scenario gets its expected outcome. Ed25519 is deterministic, so signing a committed
+`expected_signature_base` with the published seed reproduces the committed
+`Signature` byte for byte.
+
+Several negative vectors carry valid signatures on purpose: `001`, `003`, `006`,
+and `007` verify once the targeted check is removed, and `004` verifies under a
+verifier that looks keys up by thumbprint alone. A verifier that accepts one of
+them has skipped a profile rule.
+
+## Running and regenerating
+
+- `python -m iab_agentic_primitives.web_bot_auth.conformance run [--adapter "<command>"]`
+  grades an implementation through the adapter protocol of
+  `conformance/PROTOCOL.md`, which ships beside these files.
+- `python -m iab_agentic_primitives.web_bot_auth.conformance --regenerate`
+  writes every file here except this README, from the generator, and deletes
+  a vector the generator no longer produces; nothing else is touched.
+  `--check` names each file that differs, is missing, or isn't generated, and
+  exits 1 when there is one. Don't edit the vector files by hand.
+- `tests/web_bot_auth/interop/run.mjs` grades the same files against
+  Cloudflare's `web-bot-auth` library.
diff --git a/src/iab_agentic_primitives/web_bot_auth/vectors/keys.json b/src/iab_agentic_primitives/web_bot_auth/vectors/keys.json
new file mode 100644
index 0000000..c5c5541
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/vectors/keys.json
@@ -0,0 +1,35 @@
+{
+  "$comment": "Public test keys for the Web Bot Auth profile conformance vectors. The private seeds are published so that implementations can reproduce every signature. Each seed is SHA-256 of the ASCII string 'aamp-wba-test/<seed_name>'. Web Bot Auth section 6.8: test keys MUST NOT be used in production, and verifiers SHOULD reject them when detected. Each kid is the RFC 7638 JWK thumbprint (RFC 8037 Appendix A.3 for Ed25519). Each entry's identity is the origin whose key directory publishes the key.",
+  "keys": [
+    {
+      "identity": "https://buyer.example.com",
+      "seed_name": "buyer-request",
+      "kty": "OKP",
+      "crv": "Ed25519",
+      "kid": "T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84",
+      "x": "eaZpKteR6m0v7GQPeK0Hv4B0DdvqI99SsTPztodAE5w",
+      "use": "sig",
+      "_private_d_for_test_only": "g44DZG8rBK01xgiEFitrDE95iH3gnIFS4fF9PKPboMI"
+    },
+    {
+      "identity": "https://other.example.com",
+      "seed_name": "other-request",
+      "kty": "OKP",
+      "crv": "Ed25519",
+      "kid": "VR0Gby4SzMlU2nttpc8Ondksz1_VWMBzuycc-DzuQHc",
+      "x": "8BO_l61Nj5t5vhKM-HtfG19YsGG616DIr4ua9vdWxko",
+      "use": "sig",
+      "_private_d_for_test_only": "aka63hqHs29Iu_kAOdgfPg0dPUjDdml9Sc-vOU2t-lw"
+    },
+    {
+      "identity": "https://seller.example.com",
+      "seed_name": "seller-response",
+      "kty": "OKP",
+      "crv": "Ed25519",
+      "kid": "-Rmj_GuEunGbO4x6GQSMCCi0P6oZ32paBkWMnvo3gDU",
+      "x": "O2bxA-9_Zieq0cojD3MrpDjUrMla41lwZMGIwmit9IQ",
+      "use": "sig",
+      "_private_d_for_test_only": "XBBbjz0evXFV4vCLsjmFoWb7riH8qdrvRwGhNEmCDs8"
+    }
+  ]
+}
diff --git a/src/iab_agentic_primitives/web_bot_auth/vectors/negative/001-missing-nonce.json b/src/iab_agentic_primitives/web_bot_auth/vectors/negative/001-missing-nonce.json
new file mode 100644
index 0000000..9b77085
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/vectors/negative/001-missing-nonce.json
@@ -0,0 +1,64 @@
+{
+  "name": "Signature-Input omits the nonce parameter",
+  "tier": "profile",
+  "spec": "OpenProposal 3.0 § 2.8",
+  "spec_reference": "https://github.com/IABTechLab/iab-agentic-primitives/blob/main/WEB_BOT_AUTH.md#verification-procedure",
+  "signing_profile": "web-bot-auth",
+  "reference_now": 1794052810,
+  "operation": {
+    "op": "verify_request",
+    "request": {
+      "method": "POST",
+      "url": "https://seller.example.com/proposals/prop_7/commit",
+      "headers": [
+        ["Content-Type", "application/json"],
+        ["Content-Digest", "sha-256=:EuXs53uWxD5UR8fAISA74MZj5Zon8wxJPPpMOnOt0qQ=:"],
+        ["Signature-Agent", "sig1=\"https://buyer.example.com/.well-known/http-message-signatures-directory\""],
+        ["Signature-Input", "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\" \"signature-agent\";key=\"sig1\");created=1794052800;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794053100;tag=\"web-bot-auth\""],
+        ["Signature", "sig1=:l8Mvjk3mi1PUJ+ZhtZurSQejmk2elD7cID5rkxdRy0urSBvkSie/IXVTt+l+A3h63vxiZ6+E1RZ7+srITcUzCA==:"]
+      ],
+      "body": "{\"entry\":{\"role\":\"commitment\",\"version\":3,\"record_digest\":\"sha256:b88664b8699501cb1b984959d4eb663a2036b223400796f269f8ae4c0762ec9f\",\"line_item_ids\":[\"li_1\"],\"at\":\"2026-11-07T12:00:00Z\",\"idempotency_key\":\"ba1fd8f3-d695-4e8d-8629-ee4073b4f184\"},\"writes\":{\"li_1\":{\"commitment\":{\"flight\":{\"start\":\"2026-12-01T00:00:00Z\",\"end\":\"2026-12-31T23:59:59Z\"}}}}}"
+    },
+    "authority": "seller.example.com",
+    "directories": {
+      "https://buyer.example.com": {
+        "url": "https://buyer.example.com/.well-known/http-message-signatures-directory",
+        "status": 200,
+        "headers": [
+          ["Content-Type", "application/http-message-signatures-directory+json"],
+          ["Cache-Control", "max-age=300"],
+          ["Content-Digest", "sha-256=:sUHrMjQsBZ1gtBzN6hY0J17RIkyWE9GveUwZ09Yz+KU=:"],
+          ["Signature-Input", "key1=(\"@authority\";req \"content-digest\");created=1794052810;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794139210;tag=\"http-message-signatures-directory\""],
+          ["Signature", "key1=:0Bb3wTK5UolNusnjC2jMXxuBGXChENGXKt4OfXRjaWZm+qiRMriBCWrY4WFbsn+GrCOC0OpVrayNRIgcmsEqBw==:"]
+        ],
+        "body": "{\n  \"keys\": [\n    {\n      \"kty\": \"OKP\",\n      \"crv\": \"Ed25519\",\n      \"kid\": \"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\",\n      \"x\": \"eaZpKteR6m0v7GQPeK0Hv4B0DdvqI99SsTPztodAE5w\",\n      \"use\": \"sig\"\n    }\n  ]\n}"
+      }
+    },
+    "now": 1794052810,
+    "prior": []
+  },
+  "replay_cache_entries": [],
+  "expected_signature_base": {
+    "sig1": "\"@method\": POST\n\"@target-uri\": https://seller.example.com/proposals/prop_7/commit\n\"@authority\": seller.example.com\n\"content-type\": application/json\n\"content-digest\": sha-256=:EuXs53uWxD5UR8fAISA74MZj5Zon8wxJPPpMOnOt0qQ=:\n\"signature-agent\";key=\"sig1\": \"https://buyer.example.com/.well-known/http-message-signatures-directory\"\n\"@signature-params\": (\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\" \"signature-agent\";key=\"sig1\");created=1794052800;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794053100;tag=\"web-bot-auth\""
+  },
+  "expected": {
+    "ok": false,
+    "rule": "nonce-missing",
+    "status": 403,
+    "accept_signature": {
+      "label": "sig1",
+      "components": "(\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\" \"signature-agent\";key=\"sig1\")",
+      "parameters": [
+        "created",
+        "expires",
+        "nonce",
+        "keyid",
+        "alg",
+        "tag"
+      ],
+      "tag": "web-bot-auth"
+    },
+    "rationale": "The profile requires an RFC 9421 nonce on every signed request. Without one the verifier cannot detect replay."
+  },
+  "$comment": "The signature is cryptographically valid over its covered components, so a verifier that does not enforce the nonce requirement accepts it."
+}
diff --git a/src/iab_agentic_primitives/web_bot_auth/vectors/negative/002-replayed-nonce.json b/src/iab_agentic_primitives/web_bot_auth/vectors/negative/002-replayed-nonce.json
new file mode 100644
index 0000000..b242114
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/vectors/negative/002-replayed-nonce.json
@@ -0,0 +1,84 @@
+{
+  "name": "Second submission of a request whose (identity, nonce) pair the verifier has already accepted",
+  "tier": "profile",
+  "spec": "OpenProposal 3.0 § 2.8",
+  "spec_reference": "https://github.com/IABTechLab/iab-agentic-primitives/blob/main/WEB_BOT_AUTH.md#verification-procedure",
+  "signing_profile": "web-bot-auth",
+  "reference_now": 1794052815,
+  "operation": {
+    "op": "verify_request",
+    "request": {
+      "method": "POST",
+      "url": "https://seller.example.com/proposals/prop_7/commit",
+      "headers": [
+        ["Content-Type", "application/json"],
+        ["Content-Digest", "sha-256=:EuXs53uWxD5UR8fAISA74MZj5Zon8wxJPPpMOnOt0qQ=:"],
+        ["Signature-Agent", "sig1=\"https://buyer.example.com/.well-known/http-message-signatures-directory\""],
+        ["Signature-Input", "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\" \"signature-agent\";key=\"sig1\");created=1794052800;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794053100;nonce=\"u3UIzgyJ1lcWwy3bW-sgBjTzto9bC55plCFjW5d7IXTNK8IpYPmaJxCahFuBPx7aaVJQn5S_JCogXc4V9eUAdg\";tag=\"web-bot-auth\""],
+        ["Signature", "sig1=:s5iVKzp/KDKOfXX9nBlU9o4j6ACeNoQnmxu3IcwtkEk1m6b12N1intmAHoig3TqAvevzdP3NCjSgKKtqGd/XBA==:"]
+      ],
+      "body": "{\"entry\":{\"role\":\"commitment\",\"version\":3,\"record_digest\":\"sha256:b88664b8699501cb1b984959d4eb663a2036b223400796f269f8ae4c0762ec9f\",\"line_item_ids\":[\"li_1\"],\"at\":\"2026-11-07T12:00:00Z\",\"idempotency_key\":\"ba1fd8f3-d695-4e8d-8629-ee4073b4f184\"},\"writes\":{\"li_1\":{\"commitment\":{\"flight\":{\"start\":\"2026-12-01T00:00:00Z\",\"end\":\"2026-12-31T23:59:59Z\"}}}}}"
+    },
+    "authority": "seller.example.com",
+    "directories": {
+      "https://buyer.example.com": {
+        "url": "https://buyer.example.com/.well-known/http-message-signatures-directory",
+        "status": 200,
+        "headers": [
+          ["Content-Type", "application/http-message-signatures-directory+json"],
+          ["Cache-Control", "max-age=300"],
+          ["Content-Digest", "sha-256=:sUHrMjQsBZ1gtBzN6hY0J17RIkyWE9GveUwZ09Yz+KU=:"],
+          ["Signature-Input", "key1=(\"@authority\";req \"content-digest\");created=1794052815;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794139215;tag=\"http-message-signatures-directory\""],
+          ["Signature", "key1=:x+0e7dcW1LwMle04ZI/4SIxU9tXnlXrz9k8Wnq1wC581zW7KBkxAmqMQ3GVmb1oE4N+DwmJwBQbpttmZM1BXAg==:"]
+        ],
+        "body": "{\n  \"keys\": [\n    {\n      \"kty\": \"OKP\",\n      \"crv\": \"Ed25519\",\n      \"kid\": \"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\",\n      \"x\": \"eaZpKteR6m0v7GQPeK0Hv4B0DdvqI99SsTPztodAE5w\",\n      \"use\": \"sig\"\n    }\n  ]\n}"
+      }
+    },
+    "now": 1794052815,
+    "prior": [
+      {
+        "method": "POST",
+        "url": "https://seller.example.com/proposals/prop_7/commit",
+        "headers": [
+          ["Content-Type", "application/json"],
+          ["Content-Digest", "sha-256=:EuXs53uWxD5UR8fAISA74MZj5Zon8wxJPPpMOnOt0qQ=:"],
+          ["Signature-Agent", "sig1=\"https://buyer.example.com/.well-known/http-message-signatures-directory\""],
+          ["Signature-Input", "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\" \"signature-agent\";key=\"sig1\");created=1794052800;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794053100;nonce=\"u3UIzgyJ1lcWwy3bW-sgBjTzto9bC55plCFjW5d7IXTNK8IpYPmaJxCahFuBPx7aaVJQn5S_JCogXc4V9eUAdg\";tag=\"web-bot-auth\""],
+          ["Signature", "sig1=:s5iVKzp/KDKOfXX9nBlU9o4j6ACeNoQnmxu3IcwtkEk1m6b12N1intmAHoig3TqAvevzdP3NCjSgKKtqGd/XBA==:"]
+        ],
+        "body": "{\"entry\":{\"role\":\"commitment\",\"version\":3,\"record_digest\":\"sha256:b88664b8699501cb1b984959d4eb663a2036b223400796f269f8ae4c0762ec9f\",\"line_item_ids\":[\"li_1\"],\"at\":\"2026-11-07T12:00:00Z\",\"idempotency_key\":\"ba1fd8f3-d695-4e8d-8629-ee4073b4f184\"},\"writes\":{\"li_1\":{\"commitment\":{\"flight\":{\"start\":\"2026-12-01T00:00:00Z\",\"end\":\"2026-12-31T23:59:59Z\"}}}}}"
+      }
+    ]
+  },
+  "replay_cache_entries": [
+    {
+      "identity": "https://buyer.example.com",
+      "nonce": "u3UIzgyJ1lcWwy3bW-sgBjTzto9bC55plCFjW5d7IXTNK8IpYPmaJxCahFuBPx7aaVJQn5S_JCogXc4V9eUAdg",
+      "ttl_seconds": 360
+    }
+  ],
+  "expected_signature_base": {
+    "sig1": "\"@method\": POST\n\"@target-uri\": https://seller.example.com/proposals/prop_7/commit\n\"@authority\": seller.example.com\n\"content-type\": application/json\n\"content-digest\": sha-256=:EuXs53uWxD5UR8fAISA74MZj5Zon8wxJPPpMOnOt0qQ=:\n\"signature-agent\";key=\"sig1\": \"https://buyer.example.com/.well-known/http-message-signatures-directory\"\n\"@signature-params\": (\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\" \"signature-agent\";key=\"sig1\");created=1794052800;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794053100;nonce=\"u3UIzgyJ1lcWwy3bW-sgBjTzto9bC55plCFjW5d7IXTNK8IpYPmaJxCahFuBPx7aaVJQn5S_JCogXc4V9eUAdg\";tag=\"web-bot-auth\""
+  },
+  "expected": {
+    "ok": false,
+    "rule": "nonce-replayed",
+    "status": 429,
+    "accept_signature": {
+      "label": "sig1",
+      "components": "(\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\" \"signature-agent\";key=\"sig1\")",
+      "parameters": [
+        "created",
+        "expires",
+        "nonce",
+        "keyid",
+        "alg",
+        "tag"
+      ],
+      "tag": "web-bot-auth",
+      "nonce": "verifier-chosen"
+    },
+    "rationale": "The verifier MUST reject a nonce it has already seen for the same identity within the signature's lifetime."
+  },
+  "$comment": "The request is byte-identical to positive/001-single-signer-request.json. A black-box runner verifies prior.verified_requests first, then this request; a white-box harness injects prior.replay_cache_entries instead."
+}
diff --git a/src/iab_agentic_primitives/web_bot_auth/vectors/negative/003-signature-agent-not-covered.json b/src/iab_agentic_primitives/web_bot_auth/vectors/negative/003-signature-agent-not-covered.json
new file mode 100644
index 0000000..9e6e23a
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/vectors/negative/003-signature-agent-not-covered.json
@@ -0,0 +1,64 @@
+{
+  "name": "Signature-Agent header present, but the sig1 member is not a covered component",
+  "tier": "wba",
+  "spec": "OpenProposal 3.0 § 2.8",
+  "spec_reference": "https://github.com/IABTechLab/iab-agentic-primitives/blob/main/WEB_BOT_AUTH.md#profile-rules",
+  "signing_profile": "web-bot-auth",
+  "reference_now": 1794052810,
+  "operation": {
+    "op": "verify_request",
+    "request": {
+      "method": "POST",
+      "url": "https://seller.example.com/proposals/prop_7/commit",
+      "headers": [
+        ["Content-Type", "application/json"],
+        ["Content-Digest", "sha-256=:EuXs53uWxD5UR8fAISA74MZj5Zon8wxJPPpMOnOt0qQ=:"],
+        ["Signature-Agent", "sig1=\"https://buyer.example.com/.well-known/http-message-signatures-directory\""],
+        ["Signature-Input", "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\");created=1794052800;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794053100;nonce=\"e83dKbxwGNSC-TVsz4q94N2MYtlv6bqR1_WJnKF3iUwaydDZ0gWtPTOdMfvM3DaPtE0vFkBts8RfUwjNgbQ-9A\";tag=\"web-bot-auth\""],
+        ["Signature", "sig1=:gGbpqveHkXp/9jNtzWzrIVvyiT/M/8DRd/KDL+dn0zW5KXEpLHsOyr/MRYmJjhMWPzMpC0yNiA/nscJL18qbDA==:"]
+      ],
+      "body": "{\"entry\":{\"role\":\"commitment\",\"version\":3,\"record_digest\":\"sha256:b88664b8699501cb1b984959d4eb663a2036b223400796f269f8ae4c0762ec9f\",\"line_item_ids\":[\"li_1\"],\"at\":\"2026-11-07T12:00:00Z\",\"idempotency_key\":\"ba1fd8f3-d695-4e8d-8629-ee4073b4f184\"},\"writes\":{\"li_1\":{\"commitment\":{\"flight\":{\"start\":\"2026-12-01T00:00:00Z\",\"end\":\"2026-12-31T23:59:59Z\"}}}}}"
+    },
+    "authority": "seller.example.com",
+    "directories": {
+      "https://buyer.example.com": {
+        "url": "https://buyer.example.com/.well-known/http-message-signatures-directory",
+        "status": 200,
+        "headers": [
+          ["Content-Type", "application/http-message-signatures-directory+json"],
+          ["Cache-Control", "max-age=300"],
+          ["Content-Digest", "sha-256=:sUHrMjQsBZ1gtBzN6hY0J17RIkyWE9GveUwZ09Yz+KU=:"],
+          ["Signature-Input", "key1=(\"@authority\";req \"content-digest\");created=1794052810;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794139210;tag=\"http-message-signatures-directory\""],
+          ["Signature", "key1=:0Bb3wTK5UolNusnjC2jMXxuBGXChENGXKt4OfXRjaWZm+qiRMriBCWrY4WFbsn+GrCOC0OpVrayNRIgcmsEqBw==:"]
+        ],
+        "body": "{\n  \"keys\": [\n    {\n      \"kty\": \"OKP\",\n      \"crv\": \"Ed25519\",\n      \"kid\": \"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\",\n      \"x\": \"eaZpKteR6m0v7GQPeK0Hv4B0DdvqI99SsTPztodAE5w\",\n      \"use\": \"sig\"\n    }\n  ]\n}"
+      }
+    },
+    "now": 1794052810,
+    "prior": []
+  },
+  "replay_cache_entries": [],
+  "expected_signature_base": {
+    "sig1": "\"@method\": POST\n\"@target-uri\": https://seller.example.com/proposals/prop_7/commit\n\"@authority\": seller.example.com\n\"content-type\": application/json\n\"content-digest\": sha-256=:EuXs53uWxD5UR8fAISA74MZj5Zon8wxJPPpMOnOt0qQ=:\n\"@signature-params\": (\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\");created=1794052800;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794053100;nonce=\"e83dKbxwGNSC-TVsz4q94N2MYtlv6bqR1_WJnKF3iUwaydDZ0gWtPTOdMfvM3DaPtE0vFkBts8RfUwjNgbQ-9A\";tag=\"web-bot-auth\""
+  },
+  "expected": {
+    "ok": false,
+    "rule": "signature-agent-not-covered",
+    "status": 403,
+    "accept_signature": {
+      "label": "sig1",
+      "components": "(\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\" \"signature-agent\";key=\"sig1\")",
+      "parameters": [
+        "created",
+        "expires",
+        "nonce",
+        "keyid",
+        "alg",
+        "tag"
+      ],
+      "tag": "web-bot-auth"
+    },
+    "rationale": "Web Bot Auth section 5.2.1: the Signature-Agent member keyed to the signature label MUST be signed as a component. An uncovered member is an unverified claim (section 4.1)."
+  },
+  "$comment": "The signature verifies over the components it does cover, so a verifier that reads the identity from the uncovered header and skips the coverage check attributes the request to an origin nobody signed for."
+}
diff --git a/src/iab_agentic_primitives/web_bot_auth/vectors/negative/004-key-not-in-named-directory.json b/src/iab_agentic_primitives/web_bot_auth/vectors/negative/004-key-not-in-named-directory.json
new file mode 100644
index 0000000..85bd0d9
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/vectors/negative/004-key-not-in-named-directory.json
@@ -0,0 +1,76 @@
+{
+  "name": "Signature-Agent names https://other.example.com, but the signing key is published only by https://buyer.example.com",
+  "tier": "wba",
+  "spec": "OpenProposal 3.0 § 2.8",
+  "spec_reference": "https://github.com/IABTechLab/iab-agentic-primitives/blob/main/WEB_BOT_AUTH.md#profile-rules",
+  "signing_profile": "web-bot-auth",
+  "reference_now": 1794052810,
+  "operation": {
+    "op": "verify_request",
+    "request": {
+      "method": "POST",
+      "url": "https://seller.example.com/proposals/prop_7/commit",
+      "headers": [
+        ["Content-Type", "application/json"],
+        ["Content-Digest", "sha-256=:EuXs53uWxD5UR8fAISA74MZj5Zon8wxJPPpMOnOt0qQ=:"],
+        ["Signature-Agent", "sig1=\"https://other.example.com/.well-known/http-message-signatures-directory\""],
+        ["Signature-Input", "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\" \"signature-agent\";key=\"sig1\");created=1794052800;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794053100;nonce=\"uscS52UQA89DChINZ4juFr3gFr8uGtEmrVJOomRNnn7kIrXAkNy3lgNLRwD9N1OdwwIYSOZQDkZ92d3cETfhVg\";tag=\"web-bot-auth\""],
+        ["Signature", "sig1=:Srl4NfKUlRm5lgg8fUHPUeAjiZJvYdj+8iU0BKrrx/9dIJX+2lIFAFSa+OHH6f9WdAXxdbZKX2L+o3XArdxqAg==:"]
+      ],
+      "body": "{\"entry\":{\"role\":\"commitment\",\"version\":3,\"record_digest\":\"sha256:b88664b8699501cb1b984959d4eb663a2036b223400796f269f8ae4c0762ec9f\",\"line_item_ids\":[\"li_1\"],\"at\":\"2026-11-07T12:00:00Z\",\"idempotency_key\":\"ba1fd8f3-d695-4e8d-8629-ee4073b4f184\"},\"writes\":{\"li_1\":{\"commitment\":{\"flight\":{\"start\":\"2026-12-01T00:00:00Z\",\"end\":\"2026-12-31T23:59:59Z\"}}}}}"
+    },
+    "authority": "seller.example.com",
+    "directories": {
+      "https://other.example.com": {
+        "url": "https://other.example.com/.well-known/http-message-signatures-directory",
+        "status": 200,
+        "headers": [
+          ["Content-Type", "application/http-message-signatures-directory+json"],
+          ["Cache-Control", "max-age=300"],
+          ["Content-Digest", "sha-256=:6ptKfJ2BtvWVIyqkzyFq1wwTKWinMqGErtX7GxL4VOs=:"],
+          ["Signature-Input", "key1=(\"@authority\";req \"content-digest\");created=1794052810;keyid=\"VR0Gby4SzMlU2nttpc8Ondksz1_VWMBzuycc-DzuQHc\";alg=\"ed25519\";expires=1794139210;tag=\"http-message-signatures-directory\""],
+          ["Signature", "key1=:rMiIsOmeCTz0zF6SHqZYudT8JpyzarTMXhz4gdOIh1VdpYUKNEOzBKFrjzO0pOi6EcD2XR4mFkCzebkvgWkXDw==:"]
+        ],
+        "body": "{\n  \"keys\": [\n    {\n      \"kty\": \"OKP\",\n      \"crv\": \"Ed25519\",\n      \"kid\": \"VR0Gby4SzMlU2nttpc8Ondksz1_VWMBzuycc-DzuQHc\",\n      \"x\": \"8BO_l61Nj5t5vhKM-HtfG19YsGG616DIr4ua9vdWxko\",\n      \"use\": \"sig\"\n    }\n  ]\n}"
+      },
+      "https://buyer.example.com": {
+        "url": "https://buyer.example.com/.well-known/http-message-signatures-directory",
+        "status": 200,
+        "headers": [
+          ["Content-Type", "application/http-message-signatures-directory+json"],
+          ["Cache-Control", "max-age=300"],
+          ["Content-Digest", "sha-256=:sUHrMjQsBZ1gtBzN6hY0J17RIkyWE9GveUwZ09Yz+KU=:"],
+          ["Signature-Input", "key1=(\"@authority\";req \"content-digest\");created=1794052810;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794139210;tag=\"http-message-signatures-directory\""],
+          ["Signature", "key1=:0Bb3wTK5UolNusnjC2jMXxuBGXChENGXKt4OfXRjaWZm+qiRMriBCWrY4WFbsn+GrCOC0OpVrayNRIgcmsEqBw==:"]
+        ],
+        "body": "{\n  \"keys\": [\n    {\n      \"kty\": \"OKP\",\n      \"crv\": \"Ed25519\",\n      \"kid\": \"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\",\n      \"x\": \"eaZpKteR6m0v7GQPeK0Hv4B0DdvqI99SsTPztodAE5w\",\n      \"use\": \"sig\"\n    }\n  ]\n}"
+      }
+    },
+    "now": 1794052810,
+    "prior": []
+  },
+  "replay_cache_entries": [],
+  "expected_signature_base": {
+    "sig1": "\"@method\": POST\n\"@target-uri\": https://seller.example.com/proposals/prop_7/commit\n\"@authority\": seller.example.com\n\"content-type\": application/json\n\"content-digest\": sha-256=:EuXs53uWxD5UR8fAISA74MZj5Zon8wxJPPpMOnOt0qQ=:\n\"signature-agent\";key=\"sig1\": \"https://other.example.com/.well-known/http-message-signatures-directory\"\n\"@signature-params\": (\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\" \"signature-agent\";key=\"sig1\");created=1794052800;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794053100;nonce=\"uscS52UQA89DChINZ4juFr3gFr8uGtEmrVJOomRNnn7kIrXAkNy3lgNLRwD9N1OdwwIYSOZQDkZ92d3cETfhVg\";tag=\"web-bot-auth\""
+  },
+  "expected": {
+    "ok": false,
+    "rule": "key-not-found",
+    "status": 403,
+    "accept_signature": {
+      "label": "sig1",
+      "components": "(\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\" \"signature-agent\";key=\"sig1\")",
+      "parameters": [
+        "created",
+        "expires",
+        "nonce",
+        "keyid",
+        "alg",
+        "tag"
+      ],
+      "tag": "web-bot-auth"
+    },
+    "rationale": "Key lookup is keyed on the (origin, keyid) pair, never on keyid alone (Web Bot Auth section 5.4). The directory at the named origin holds no key with this thumbprint."
+  },
+  "$comment": "The signature is valid under the buyer's key, and directories lists that key under its own origin so a harness can show the trap: a verifier that indexes keys by thumbprint alone finds the key and attributes the request to https://other.example.com, an origin that never published it."
+}
diff --git a/src/iab_agentic_primitives/web_bot_auth/vectors/negative/005-malformed-signature-agent.json b/src/iab_agentic_primitives/web_bot_auth/vectors/negative/005-malformed-signature-agent.json
new file mode 100644
index 0000000..c7afe47
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/vectors/negative/005-malformed-signature-agent.json
@@ -0,0 +1,48 @@
+{
+  "name": "Signature-Agent is not a parseable Structured Field Dictionary (unterminated string)",
+  "tier": "wba",
+  "spec": "OpenProposal 3.0 § 2.8",
+  "spec_reference": "https://github.com/IABTechLab/iab-agentic-primitives/blob/main/WEB_BOT_AUTH.md#verification-procedure",
+  "signing_profile": "web-bot-auth",
+  "reference_now": 1794052810,
+  "operation": {
+    "op": "verify_request",
+    "request": {
+      "method": "POST",
+      "url": "https://seller.example.com/proposals/prop_7/commit",
+      "headers": [
+        ["Content-Type", "application/json"],
+        ["Content-Digest", "sha-256=:EuXs53uWxD5UR8fAISA74MZj5Zon8wxJPPpMOnOt0qQ=:"],
+        ["Signature-Agent", "sig1=\"https://buyer.example.com/.well-known/http-message-signatures-directory"],
+        ["Signature-Input", "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\" \"signature-agent\";key=\"sig1\");created=1794052800;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794053100;nonce=\"u3UIzgyJ1lcWwy3bW-sgBjTzto9bC55plCFjW5d7IXTNK8IpYPmaJxCahFuBPx7aaVJQn5S_JCogXc4V9eUAdg\";tag=\"web-bot-auth\""],
+        ["Signature", "sig1=:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==:"]
+      ],
+      "body": "{\"entry\":{\"role\":\"commitment\",\"version\":3,\"record_digest\":\"sha256:b88664b8699501cb1b984959d4eb663a2036b223400796f269f8ae4c0762ec9f\",\"line_item_ids\":[\"li_1\"],\"at\":\"2026-11-07T12:00:00Z\",\"idempotency_key\":\"ba1fd8f3-d695-4e8d-8629-ee4073b4f184\"},\"writes\":{\"li_1\":{\"commitment\":{\"flight\":{\"start\":\"2026-12-01T00:00:00Z\",\"end\":\"2026-12-31T23:59:59Z\"}}}}}"
+    },
+    "authority": "seller.example.com",
+    "directories": {
+      "https://buyer.example.com": {
+        "url": "https://buyer.example.com/.well-known/http-message-signatures-directory",
+        "status": 200,
+        "headers": [
+          ["Content-Type", "application/http-message-signatures-directory+json"],
+          ["Cache-Control", "max-age=300"],
+          ["Content-Digest", "sha-256=:sUHrMjQsBZ1gtBzN6hY0J17RIkyWE9GveUwZ09Yz+KU=:"],
+          ["Signature-Input", "key1=(\"@authority\";req \"content-digest\");created=1794052810;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794139210;tag=\"http-message-signatures-directory\""],
+          ["Signature", "key1=:0Bb3wTK5UolNusnjC2jMXxuBGXChENGXKt4OfXRjaWZm+qiRMriBCWrY4WFbsn+GrCOC0OpVrayNRIgcmsEqBw==:"]
+        ],
+        "body": "{\n  \"keys\": [\n    {\n      \"kty\": \"OKP\",\n      \"crv\": \"Ed25519\",\n      \"kid\": \"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\",\n      \"x\": \"eaZpKteR6m0v7GQPeK0Hv4B0DdvqI99SsTPztodAE5w\",\n      \"use\": \"sig\"\n    }\n  ]\n}"
+      }
+    },
+    "now": 1794052810,
+    "prior": []
+  },
+  "replay_cache_entries": [],
+  "expected": {
+    "ok": false,
+    "rule": "parse",
+    "status": 400,
+    "rationale": "Web Bot Auth section 5.4: a verifier that fails to parse Signature, Signature-Input, or Signature-Agent answers 400 Bad Request."
+  },
+  "$comment": "Signature is a 64-zero-byte placeholder: parsing fails before any key is resolved or any signature is checked, so a verifier that reaches cryptographic verification has skipped the parse step."
+}
diff --git a/src/iab_agentic_primitives/web_bot_auth/vectors/negative/006-two-signatures.json b/src/iab_agentic_primitives/web_bot_auth/vectors/negative/006-two-signatures.json
new file mode 100644
index 0000000..6cf14f2
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/vectors/negative/006-two-signatures.json
@@ -0,0 +1,77 @@
+{
+  "name": "Two web-bot-auth signatures on one request: positive/001 plus a second valid signature from https://other.example.com",
+  "tier": "wba",
+  "spec": "OpenProposal 3.0 § 2.8",
+  "spec_reference": "https://github.com/IABTechLab/iab-agentic-primitives/blob/main/WEB_BOT_AUTH.md#verification-procedure",
+  "signing_profile": "web-bot-auth",
+  "reference_now": 1794052810,
+  "operation": {
+    "op": "verify_request",
+    "request": {
+      "method": "POST",
+      "url": "https://seller.example.com/proposals/prop_7/commit",
+      "headers": [
+        ["Content-Type", "application/json"],
+        ["Content-Digest", "sha-256=:EuXs53uWxD5UR8fAISA74MZj5Zon8wxJPPpMOnOt0qQ=:"],
+        ["Signature-Agent", "sig1=\"https://buyer.example.com/.well-known/http-message-signatures-directory\", sig2=\"https://other.example.com/.well-known/http-message-signatures-directory\""],
+        ["Signature-Input", "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\" \"signature-agent\";key=\"sig1\");created=1794052800;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794053100;nonce=\"u3UIzgyJ1lcWwy3bW-sgBjTzto9bC55plCFjW5d7IXTNK8IpYPmaJxCahFuBPx7aaVJQn5S_JCogXc4V9eUAdg\";tag=\"web-bot-auth\", sig2=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\" \"signature-agent\";key=\"sig2\");created=1794052800;keyid=\"VR0Gby4SzMlU2nttpc8Ondksz1_VWMBzuycc-DzuQHc\";alg=\"ed25519\";expires=1794053100;nonce=\"cHa8O4gnR877AlwKMl1iWOi2vknAGIvof6j0v8aBQyzOH-2j1cBG1Nncu3koNhHcwaA5Y7BAo4g9ckK-uYQdSg\";tag=\"web-bot-auth\""],
+        ["Signature", "sig1=:s5iVKzp/KDKOfXX9nBlU9o4j6ACeNoQnmxu3IcwtkEk1m6b12N1intmAHoig3TqAvevzdP3NCjSgKKtqGd/XBA==:, sig2=:ZEca9OnBfHAlbVfLzvlakDTFywlXzywHctSfwI6rTK3cCAB/6Q+nMrfXnBV+A3xqbuvpmFY5qDM6H9J+8tirCQ==:"]
+      ],
+      "body": "{\"entry\":{\"role\":\"commitment\",\"version\":3,\"record_digest\":\"sha256:b88664b8699501cb1b984959d4eb663a2036b223400796f269f8ae4c0762ec9f\",\"line_item_ids\":[\"li_1\"],\"at\":\"2026-11-07T12:00:00Z\",\"idempotency_key\":\"ba1fd8f3-d695-4e8d-8629-ee4073b4f184\"},\"writes\":{\"li_1\":{\"commitment\":{\"flight\":{\"start\":\"2026-12-01T00:00:00Z\",\"end\":\"2026-12-31T23:59:59Z\"}}}}}"
+    },
+    "authority": "seller.example.com",
+    "directories": {
+      "https://buyer.example.com": {
+        "url": "https://buyer.example.com/.well-known/http-message-signatures-directory",
+        "status": 200,
+        "headers": [
+          ["Content-Type", "application/http-message-signatures-directory+json"],
+          ["Cache-Control", "max-age=300"],
+          ["Content-Digest", "sha-256=:sUHrMjQsBZ1gtBzN6hY0J17RIkyWE9GveUwZ09Yz+KU=:"],
+          ["Signature-Input", "key1=(\"@authority\";req \"content-digest\");created=1794052810;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794139210;tag=\"http-message-signatures-directory\""],
+          ["Signature", "key1=:0Bb3wTK5UolNusnjC2jMXxuBGXChENGXKt4OfXRjaWZm+qiRMriBCWrY4WFbsn+GrCOC0OpVrayNRIgcmsEqBw==:"]
+        ],
+        "body": "{\n  \"keys\": [\n    {\n      \"kty\": \"OKP\",\n      \"crv\": \"Ed25519\",\n      \"kid\": \"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\",\n      \"x\": \"eaZpKteR6m0v7GQPeK0Hv4B0DdvqI99SsTPztodAE5w\",\n      \"use\": \"sig\"\n    }\n  ]\n}"
+      },
+      "https://other.example.com": {
+        "url": "https://other.example.com/.well-known/http-message-signatures-directory",
+        "status": 200,
+        "headers": [
+          ["Content-Type", "application/http-message-signatures-directory+json"],
+          ["Cache-Control", "max-age=300"],
+          ["Content-Digest", "sha-256=:6ptKfJ2BtvWVIyqkzyFq1wwTKWinMqGErtX7GxL4VOs=:"],
+          ["Signature-Input", "key1=(\"@authority\";req \"content-digest\");created=1794052810;keyid=\"VR0Gby4SzMlU2nttpc8Ondksz1_VWMBzuycc-DzuQHc\";alg=\"ed25519\";expires=1794139210;tag=\"http-message-signatures-directory\""],
+          ["Signature", "key1=:rMiIsOmeCTz0zF6SHqZYudT8JpyzarTMXhz4gdOIh1VdpYUKNEOzBKFrjzO0pOi6EcD2XR4mFkCzebkvgWkXDw==:"]
+        ],
+        "body": "{\n  \"keys\": [\n    {\n      \"kty\": \"OKP\",\n      \"crv\": \"Ed25519\",\n      \"kid\": \"VR0Gby4SzMlU2nttpc8Ondksz1_VWMBzuycc-DzuQHc\",\n      \"x\": \"8BO_l61Nj5t5vhKM-HtfG19YsGG616DIr4ua9vdWxko\",\n      \"use\": \"sig\"\n    }\n  ]\n}"
+      }
+    },
+    "now": 1794052810,
+    "prior": []
+  },
+  "replay_cache_entries": [],
+  "expected_signature_base": {
+    "sig1": "\"@method\": POST\n\"@target-uri\": https://seller.example.com/proposals/prop_7/commit\n\"@authority\": seller.example.com\n\"content-type\": application/json\n\"content-digest\": sha-256=:EuXs53uWxD5UR8fAISA74MZj5Zon8wxJPPpMOnOt0qQ=:\n\"signature-agent\";key=\"sig1\": \"https://buyer.example.com/.well-known/http-message-signatures-directory\"\n\"@signature-params\": (\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\" \"signature-agent\";key=\"sig1\");created=1794052800;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794053100;nonce=\"u3UIzgyJ1lcWwy3bW-sgBjTzto9bC55plCFjW5d7IXTNK8IpYPmaJxCahFuBPx7aaVJQn5S_JCogXc4V9eUAdg\";tag=\"web-bot-auth\"",
+    "sig2": "\"@method\": POST\n\"@target-uri\": https://seller.example.com/proposals/prop_7/commit\n\"@authority\": seller.example.com\n\"content-type\": application/json\n\"content-digest\": sha-256=:EuXs53uWxD5UR8fAISA74MZj5Zon8wxJPPpMOnOt0qQ=:\n\"signature-agent\";key=\"sig2\": \"https://other.example.com/.well-known/http-message-signatures-directory\"\n\"@signature-params\": (\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\" \"signature-agent\";key=\"sig2\");created=1794052800;keyid=\"VR0Gby4SzMlU2nttpc8Ondksz1_VWMBzuycc-DzuQHc\";alg=\"ed25519\";expires=1794053100;nonce=\"cHa8O4gnR877AlwKMl1iWOi2vknAGIvof6j0v8aBQyzOH-2j1cBG1Nncu3koNhHcwaA5Y7BAo4g9ckK-uYQdSg\";tag=\"web-bot-auth\""
+  },
+  "expected": {
+    "ok": false,
+    "rule": "multiple-signatures",
+    "status": 403,
+    "accept_signature": {
+      "label": "sig1",
+      "components": "(\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\" \"signature-agent\";key=\"sig1\")",
+      "parameters": [
+        "created",
+        "expires",
+        "nonce",
+        "keyid",
+        "alg",
+        "tag"
+      ],
+      "tag": "web-bot-auth"
+    },
+    "rationale": "The profile takes exactly one web-bot-auth signature and one Signature-Agent member per request. Web Bot Auth section 5.2.2 permits more than one signature; the profile does not accept one."
+  },
+  "$comment": "The sig1 label is byte-identical to positive/001, and sig2 is a second valid signature over the same request from another identity. A verifier that accepts when each label verifies skips the count check."
+}
diff --git a/src/iab_agentic_primitives/web_bot_auth/vectors/negative/007-response-not-bound.json b/src/iab_agentic_primitives/web_bot_auth/vectors/negative/007-response-not-bound.json
new file mode 100644
index 0000000..ffadc98
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/vectors/negative/007-response-not-bound.json
@@ -0,0 +1,61 @@
+{
+  "name": "The seller's response to a signed request, not bound to that request",
+  "tier": "profile",
+  "spec": "OpenProposal 3.0 § 2.8",
+  "spec_reference": "https://github.com/IABTechLab/iab-agentic-primitives/blob/main/WEB_BOT_AUTH.md#profile-rules",
+  "signing_profile": "web-bot-auth",
+  "reference_now": 1794052810,
+  "operation": {
+    "op": "verify_response",
+    "request": {
+      "method": "POST",
+      "url": "https://seller.example.com/proposals/prop_7/commit",
+      "headers": [
+        ["Content-Type", "application/json"],
+        ["Content-Digest", "sha-256=:EuXs53uWxD5UR8fAISA74MZj5Zon8wxJPPpMOnOt0qQ=:"],
+        ["Signature-Agent", "sig1=\"https://buyer.example.com/.well-known/http-message-signatures-directory\""],
+        ["Signature-Input", "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\" \"signature-agent\";key=\"sig1\");created=1794052800;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794053100;nonce=\"u3UIzgyJ1lcWwy3bW-sgBjTzto9bC55plCFjW5d7IXTNK8IpYPmaJxCahFuBPx7aaVJQn5S_JCogXc4V9eUAdg\";tag=\"web-bot-auth\""],
+        ["Signature", "sig1=:s5iVKzp/KDKOfXX9nBlU9o4j6ACeNoQnmxu3IcwtkEk1m6b12N1intmAHoig3TqAvevzdP3NCjSgKKtqGd/XBA==:"]
+      ],
+      "body": "{\"entry\":{\"role\":\"commitment\",\"version\":3,\"record_digest\":\"sha256:b88664b8699501cb1b984959d4eb663a2036b223400796f269f8ae4c0762ec9f\",\"line_item_ids\":[\"li_1\"],\"at\":\"2026-11-07T12:00:00Z\",\"idempotency_key\":\"ba1fd8f3-d695-4e8d-8629-ee4073b4f184\"},\"writes\":{\"li_1\":{\"commitment\":{\"flight\":{\"start\":\"2026-12-01T00:00:00Z\",\"end\":\"2026-12-31T23:59:59Z\"}}}}}"
+    },
+    "response": {
+      "status": 200,
+      "headers": [
+        ["Content-Type", "application/json"],
+        ["Content-Digest", "sha-256=:MKVkbVABQlLjWYxMhW/N4sHR9zVovpkWoT/jpzUClTA=:"],
+        ["Signature-Agent", "sig1=\"https://seller.example.com/.well-known/http-message-signatures-directory\""],
+        ["Signature-Input", "sig1=(\"@status\" \"@method\";req \"@target-uri\";req \"content-type\" \"content-digest\" \"signature-agent\";key=\"sig1\");created=1794052801;keyid=\"-Rmj_GuEunGbO4x6GQSMCCi0P6oZ32paBkWMnvo3gDU\";alg=\"ed25519\";expires=1794053101;tag=\"web-bot-auth\""],
+        ["Signature", "sig1=:9U7r1TpYtQe1V9agdOICxzgfFestS3OSS5SA/8QWJUJJR68UdbyjwGAK541kz5RV/yrK4WLaPnX5+jSWuWe/AA==:"]
+      ],
+      "body": "{\"entries\":[{\"role\":\"commitment\",\"version\":3,\"record_digest\":\"sha256:b88664b8699501cb1b984959d4eb663a2036b223400796f269f8ae4c0762ec9f\",\"line_item_ids\":[\"li_1\"],\"at\":\"2026-11-07T12:00:00Z\",\"idempotency_key\":\"ba1fd8f3-d695-4e8d-8629-ee4073b4f184\"},{\"role\":\"acceptance\",\"version\":3,\"record_digest\":\"sha256:b88664b8699501cb1b984959d4eb663a2036b223400796f269f8ae4c0762ec9f\",\"line_item_ids\":[\"li_1\"],\"at\":\"2026-11-07T12:00:01Z\"}]}"
+    },
+    "directories": {
+      "https://seller.example.com": {
+        "url": "https://seller.example.com/.well-known/http-message-signatures-directory",
+        "status": 200,
+        "headers": [
+          ["Content-Type", "application/http-message-signatures-directory+json"],
+          ["Cache-Control", "max-age=300"],
+          ["Content-Digest", "sha-256=:rdSZr7OiNDjsX5TKvyuh/gdc1lz/tRonWTtqSQECWyc=:"],
+          ["Signature-Input", "key1=(\"@authority\";req \"content-digest\");created=1794052810;keyid=\"-Rmj_GuEunGbO4x6GQSMCCi0P6oZ32paBkWMnvo3gDU\";alg=\"ed25519\";expires=1794139210;tag=\"http-message-signatures-directory\""],
+          ["Signature", "key1=:G1XXn7Y7FKZ4qv0VEvNBnmFFBxQPBTueiocC2WQhQeZ4Qur1aPmF3PDTAkZLdNuysVrCjfz0TGw8A74XV5s0CQ==:"]
+        ],
+        "body": "{\n  \"keys\": [\n    {\n      \"kty\": \"OKP\",\n      \"crv\": \"Ed25519\",\n      \"kid\": \"-Rmj_GuEunGbO4x6GQSMCCi0P6oZ32paBkWMnvo3gDU\",\n      \"x\": \"O2bxA-9_Zieq0cojD3MrpDjUrMla41lwZMGIwmit9IQ\",\n      \"use\": \"sig\"\n    }\n  ]\n}"
+      }
+    },
+    "now": 1794052810,
+    "expected_origin": "https://seller.example.com"
+  },
+  "replay_cache_entries": [],
+  "expected_signature_base": {
+    "sig1": "\"@status\": 200\n\"@method\";req: POST\n\"@target-uri\";req: https://seller.example.com/proposals/prop_7/commit\n\"content-type\": application/json\n\"content-digest\": sha-256=:MKVkbVABQlLjWYxMhW/N4sHR9zVovpkWoT/jpzUClTA=:\n\"signature-agent\";key=\"sig1\": \"https://seller.example.com/.well-known/http-message-signatures-directory\"\n\"@signature-params\": (\"@status\" \"@method\";req \"@target-uri\";req \"content-type\" \"content-digest\" \"signature-agent\";key=\"sig1\");created=1794052801;keyid=\"-Rmj_GuEunGbO4x6GQSMCCi0P6oZ32paBkWMnvo3gDU\";alg=\"ed25519\";expires=1794053101;tag=\"web-bot-auth\""
+  },
+  "expected": {
+    "ok": false,
+    "rule": "response-not-bound",
+    "status": 403,
+    "rationale": "A response to a request that carried a web-bot-auth signature covers \"signature\";req;key=<request label>. Without it, the response could answer any request."
+  },
+  "$comment": "The response signature is valid over its covered components, so a verifier that does not check the binding accepts a response that could have been captured from another exchange."
+}
diff --git a/src/iab_agentic_primitives/web_bot_auth/vectors/negative/008-key-not-in-named-directory-warm-cache.json b/src/iab_agentic_primitives/web_bot_auth/vectors/negative/008-key-not-in-named-directory-warm-cache.json
new file mode 100644
index 0000000..ecf0795
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/vectors/negative/008-key-not-in-named-directory-warm-cache.json
@@ -0,0 +1,89 @@
+{
+  "name": "negative/004 after a verified request from https://buyer.example.com: the warm cache still keys on (origin, keyid)",
+  "tier": "wba",
+  "spec": "OpenProposal 3.0 § 2.8",
+  "spec_reference": "https://github.com/IABTechLab/iab-agentic-primitives/blob/main/WEB_BOT_AUTH.md#profile-rules",
+  "signing_profile": "web-bot-auth",
+  "reference_now": 1794052810,
+  "operation": {
+    "op": "verify_request",
+    "request": {
+      "method": "POST",
+      "url": "https://seller.example.com/proposals/prop_7/commit",
+      "headers": [
+        ["Content-Type", "application/json"],
+        ["Content-Digest", "sha-256=:EuXs53uWxD5UR8fAISA74MZj5Zon8wxJPPpMOnOt0qQ=:"],
+        ["Signature-Agent", "sig1=\"https://other.example.com/.well-known/http-message-signatures-directory\""],
+        ["Signature-Input", "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\" \"signature-agent\";key=\"sig1\");created=1794052800;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794053100;nonce=\"uscS52UQA89DChINZ4juFr3gFr8uGtEmrVJOomRNnn7kIrXAkNy3lgNLRwD9N1OdwwIYSOZQDkZ92d3cETfhVg\";tag=\"web-bot-auth\""],
+        ["Signature", "sig1=:Srl4NfKUlRm5lgg8fUHPUeAjiZJvYdj+8iU0BKrrx/9dIJX+2lIFAFSa+OHH6f9WdAXxdbZKX2L+o3XArdxqAg==:"]
+      ],
+      "body": "{\"entry\":{\"role\":\"commitment\",\"version\":3,\"record_digest\":\"sha256:b88664b8699501cb1b984959d4eb663a2036b223400796f269f8ae4c0762ec9f\",\"line_item_ids\":[\"li_1\"],\"at\":\"2026-11-07T12:00:00Z\",\"idempotency_key\":\"ba1fd8f3-d695-4e8d-8629-ee4073b4f184\"},\"writes\":{\"li_1\":{\"commitment\":{\"flight\":{\"start\":\"2026-12-01T00:00:00Z\",\"end\":\"2026-12-31T23:59:59Z\"}}}}}"
+    },
+    "authority": "seller.example.com",
+    "directories": {
+      "https://other.example.com": {
+        "url": "https://other.example.com/.well-known/http-message-signatures-directory",
+        "status": 200,
+        "headers": [
+          ["Content-Type", "application/http-message-signatures-directory+json"],
+          ["Cache-Control", "max-age=300"],
+          ["Content-Digest", "sha-256=:6ptKfJ2BtvWVIyqkzyFq1wwTKWinMqGErtX7GxL4VOs=:"],
+          ["Signature-Input", "key1=(\"@authority\";req \"content-digest\");created=1794052810;keyid=\"VR0Gby4SzMlU2nttpc8Ondksz1_VWMBzuycc-DzuQHc\";alg=\"ed25519\";expires=1794139210;tag=\"http-message-signatures-directory\""],
+          ["Signature", "key1=:rMiIsOmeCTz0zF6SHqZYudT8JpyzarTMXhz4gdOIh1VdpYUKNEOzBKFrjzO0pOi6EcD2XR4mFkCzebkvgWkXDw==:"]
+        ],
+        "body": "{\n  \"keys\": [\n    {\n      \"kty\": \"OKP\",\n      \"crv\": \"Ed25519\",\n      \"kid\": \"VR0Gby4SzMlU2nttpc8Ondksz1_VWMBzuycc-DzuQHc\",\n      \"x\": \"8BO_l61Nj5t5vhKM-HtfG19YsGG616DIr4ua9vdWxko\",\n      \"use\": \"sig\"\n    }\n  ]\n}"
+      },
+      "https://buyer.example.com": {
+        "url": "https://buyer.example.com/.well-known/http-message-signatures-directory",
+        "status": 200,
+        "headers": [
+          ["Content-Type", "application/http-message-signatures-directory+json"],
+          ["Cache-Control", "max-age=300"],
+          ["Content-Digest", "sha-256=:sUHrMjQsBZ1gtBzN6hY0J17RIkyWE9GveUwZ09Yz+KU=:"],
+          ["Signature-Input", "key1=(\"@authority\";req \"content-digest\");created=1794052810;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794139210;tag=\"http-message-signatures-directory\""],
+          ["Signature", "key1=:0Bb3wTK5UolNusnjC2jMXxuBGXChENGXKt4OfXRjaWZm+qiRMriBCWrY4WFbsn+GrCOC0OpVrayNRIgcmsEqBw==:"]
+        ],
+        "body": "{\n  \"keys\": [\n    {\n      \"kty\": \"OKP\",\n      \"crv\": \"Ed25519\",\n      \"kid\": \"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\",\n      \"x\": \"eaZpKteR6m0v7GQPeK0Hv4B0DdvqI99SsTPztodAE5w\",\n      \"use\": \"sig\"\n    }\n  ]\n}"
+      }
+    },
+    "now": 1794052810,
+    "prior": [
+      {
+        "method": "POST",
+        "url": "https://seller.example.com/proposals/prop_7/commit",
+        "headers": [
+          ["Content-Type", "application/json"],
+          ["Content-Digest", "sha-256=:EuXs53uWxD5UR8fAISA74MZj5Zon8wxJPPpMOnOt0qQ=:"],
+          ["Signature-Agent", "sig1=\"https://buyer.example.com/.well-known/http-message-signatures-directory\""],
+          ["Signature-Input", "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\" \"signature-agent\";key=\"sig1\");created=1794052800;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794053100;nonce=\"u3UIzgyJ1lcWwy3bW-sgBjTzto9bC55plCFjW5d7IXTNK8IpYPmaJxCahFuBPx7aaVJQn5S_JCogXc4V9eUAdg\";tag=\"web-bot-auth\""],
+          ["Signature", "sig1=:s5iVKzp/KDKOfXX9nBlU9o4j6ACeNoQnmxu3IcwtkEk1m6b12N1intmAHoig3TqAvevzdP3NCjSgKKtqGd/XBA==:"]
+        ],
+        "body": "{\"entry\":{\"role\":\"commitment\",\"version\":3,\"record_digest\":\"sha256:b88664b8699501cb1b984959d4eb663a2036b223400796f269f8ae4c0762ec9f\",\"line_item_ids\":[\"li_1\"],\"at\":\"2026-11-07T12:00:00Z\",\"idempotency_key\":\"ba1fd8f3-d695-4e8d-8629-ee4073b4f184\"},\"writes\":{\"li_1\":{\"commitment\":{\"flight\":{\"start\":\"2026-12-01T00:00:00Z\",\"end\":\"2026-12-31T23:59:59Z\"}}}}}"
+      }
+    ]
+  },
+  "replay_cache_entries": [],
+  "expected_signature_base": {
+    "sig1": "\"@method\": POST\n\"@target-uri\": https://seller.example.com/proposals/prop_7/commit\n\"@authority\": seller.example.com\n\"content-type\": application/json\n\"content-digest\": sha-256=:EuXs53uWxD5UR8fAISA74MZj5Zon8wxJPPpMOnOt0qQ=:\n\"signature-agent\";key=\"sig1\": \"https://other.example.com/.well-known/http-message-signatures-directory\"\n\"@signature-params\": (\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\" \"signature-agent\";key=\"sig1\");created=1794052800;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794053100;nonce=\"uscS52UQA89DChINZ4juFr3gFr8uGtEmrVJOomRNnn7kIrXAkNy3lgNLRwD9N1OdwwIYSOZQDkZ92d3cETfhVg\";tag=\"web-bot-auth\""
+  },
+  "expected": {
+    "ok": false,
+    "rule": "key-not-found",
+    "status": 403,
+    "accept_signature": {
+      "label": "sig1",
+      "components": "(\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\" \"signature-agent\";key=\"sig1\")",
+      "parameters": [
+        "created",
+        "expires",
+        "nonce",
+        "keyid",
+        "alg",
+        "tag"
+      ],
+      "tag": "web-bot-auth"
+    },
+    "rationale": "Key lookup is keyed on the (origin, keyid) pair, never on keyid alone (Web Bot Auth section 5.4). It holds with or without a cached directory."
+  },
+  "$comment": "The verifier first verifies positive/001-single-signer-request.json, so the directory of https://buyer.example.com is cached when this request arrives. A verifier whose cache answers any lookup from any cached directory finds the buyer's key there and attributes the request to https://other.example.com."
+}
diff --git a/src/iab_agentic_primitives/web_bot_auth/vectors/positive/001-single-signer-request.json b/src/iab_agentic_primitives/web_bot_auth/vectors/positive/001-single-signer-request.json
new file mode 100644
index 0000000..4386b80
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/vectors/positive/001-single-signer-request.json
@@ -0,0 +1,49 @@
+{
+  "name": "Single signer: the buyer agent at https://buyer.example.com commits to proposal prop_7",
+  "tier": "wba",
+  "spec": "OpenProposal 3.0 § 2.8",
+  "spec_reference": "https://github.com/IABTechLab/iab-agentic-primitives/blob/main/WEB_BOT_AUTH.md#profile-rules",
+  "signing_profile": "web-bot-auth",
+  "reference_now": 1794052810,
+  "operation": {
+    "op": "verify_request",
+    "request": {
+      "method": "POST",
+      "url": "https://seller.example.com/proposals/prop_7/commit",
+      "headers": [
+        ["Content-Type", "application/json"],
+        ["Content-Digest", "sha-256=:EuXs53uWxD5UR8fAISA74MZj5Zon8wxJPPpMOnOt0qQ=:"],
+        ["Signature-Agent", "sig1=\"https://buyer.example.com/.well-known/http-message-signatures-directory\""],
+        ["Signature-Input", "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\" \"signature-agent\";key=\"sig1\");created=1794052800;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794053100;nonce=\"u3UIzgyJ1lcWwy3bW-sgBjTzto9bC55plCFjW5d7IXTNK8IpYPmaJxCahFuBPx7aaVJQn5S_JCogXc4V9eUAdg\";tag=\"web-bot-auth\""],
+        ["Signature", "sig1=:s5iVKzp/KDKOfXX9nBlU9o4j6ACeNoQnmxu3IcwtkEk1m6b12N1intmAHoig3TqAvevzdP3NCjSgKKtqGd/XBA==:"]
+      ],
+      "body": "{\"entry\":{\"role\":\"commitment\",\"version\":3,\"record_digest\":\"sha256:b88664b8699501cb1b984959d4eb663a2036b223400796f269f8ae4c0762ec9f\",\"line_item_ids\":[\"li_1\"],\"at\":\"2026-11-07T12:00:00Z\",\"idempotency_key\":\"ba1fd8f3-d695-4e8d-8629-ee4073b4f184\"},\"writes\":{\"li_1\":{\"commitment\":{\"flight\":{\"start\":\"2026-12-01T00:00:00Z\",\"end\":\"2026-12-31T23:59:59Z\"}}}}}"
+    },
+    "authority": "seller.example.com",
+    "directories": {
+      "https://buyer.example.com": {
+        "url": "https://buyer.example.com/.well-known/http-message-signatures-directory",
+        "status": 200,
+        "headers": [
+          ["Content-Type", "application/http-message-signatures-directory+json"],
+          ["Cache-Control", "max-age=300"],
+          ["Content-Digest", "sha-256=:sUHrMjQsBZ1gtBzN6hY0J17RIkyWE9GveUwZ09Yz+KU=:"],
+          ["Signature-Input", "key1=(\"@authority\";req \"content-digest\");created=1794052810;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794139210;tag=\"http-message-signatures-directory\""],
+          ["Signature", "key1=:0Bb3wTK5UolNusnjC2jMXxuBGXChENGXKt4OfXRjaWZm+qiRMriBCWrY4WFbsn+GrCOC0OpVrayNRIgcmsEqBw==:"]
+        ],
+        "body": "{\n  \"keys\": [\n    {\n      \"kty\": \"OKP\",\n      \"crv\": \"Ed25519\",\n      \"kid\": \"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\",\n      \"x\": \"eaZpKteR6m0v7GQPeK0Hv4B0DdvqI99SsTPztodAE5w\",\n      \"use\": \"sig\"\n    }\n  ]\n}"
+      }
+    },
+    "now": 1794052810,
+    "prior": []
+  },
+  "replay_cache_entries": [],
+  "expected_signature_base": {
+    "sig1": "\"@method\": POST\n\"@target-uri\": https://seller.example.com/proposals/prop_7/commit\n\"@authority\": seller.example.com\n\"content-type\": application/json\n\"content-digest\": sha-256=:EuXs53uWxD5UR8fAISA74MZj5Zon8wxJPPpMOnOt0qQ=:\n\"signature-agent\";key=\"sig1\": \"https://buyer.example.com/.well-known/http-message-signatures-directory\"\n\"@signature-params\": (\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\" \"signature-agent\";key=\"sig1\");created=1794052800;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794053100;nonce=\"u3UIzgyJ1lcWwy3bW-sgBjTzto9bC55plCFjW5d7IXTNK8IpYPmaJxCahFuBPx7aaVJQn5S_JCogXc4V9eUAdg\";tag=\"web-bot-auth\""
+  },
+  "expected": {
+    "ok": true,
+    "identity": "https://buyer.example.com"
+  },
+  "$comment": "The Signature-Agent member sig1 names the key directory URL https://buyer.example.com/.well-known/http-message-signatures-directory, so the verifier fetches it, selects the key whose kid equals keyid, and attributes the request to the origin https://buyer.example.com. Ed25519 is deterministic, so an implementation signing expected_signature_base with the published seed reproduces the Signature value byte for byte."
+}
diff --git a/src/iab_agentic_primitives/web_bot_auth/vectors/positive/002-signed-directory-response.json b/src/iab_agentic_primitives/web_bot_auth/vectors/positive/002-signed-directory-response.json
new file mode 100644
index 0000000..eda08da
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/vectors/positive/002-signed-directory-response.json
@@ -0,0 +1,32 @@
+{
+  "name": "Signed key directory response for https://buyer.example.com, one signature per key",
+  "tier": "wba",
+  "spec": "OpenProposal 3.0 § 2.8",
+  "spec_reference": "https://github.com/IABTechLab/iab-agentic-primitives/blob/main/WEB_BOT_AUTH.md#profile-rules",
+  "signing_profile": "web-bot-auth",
+  "reference_now": 1794052810,
+  "operation": {
+    "op": "verify_directory",
+    "origin": "https://buyer.example.com",
+    "response": {
+      "status": 200,
+      "headers": [
+        ["Content-Type", "application/http-message-signatures-directory+json"],
+        ["Cache-Control", "max-age=300"],
+        ["Content-Digest", "sha-256=:sUHrMjQsBZ1gtBzN6hY0J17RIkyWE9GveUwZ09Yz+KU=:"],
+        ["Signature-Input", "key1=(\"@authority\";req \"content-digest\");created=1794052200;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794138600;tag=\"http-message-signatures-directory\""],
+        ["Signature", "key1=:06Nk7YQaA3XtUO0SJOTWLqcptz/FRehPH2p7tleFIyLyiSlX8eT0xAtABKy1JiN7NNIl1wU+7TbM43ZiUow6Ag==:"]
+      ],
+      "body": "{\n  \"keys\": [\n    {\n      \"kty\": \"OKP\",\n      \"crv\": \"Ed25519\",\n      \"kid\": \"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\",\n      \"x\": \"eaZpKteR6m0v7GQPeK0Hv4B0DdvqI99SsTPztodAE5w\",\n      \"use\": \"sig\"\n    }\n  ]\n}"
+    },
+    "now": 1794052810
+  },
+  "replay_cache_entries": [],
+  "expected_signature_base": {
+    "key1": "\"@authority\";req: buyer.example.com\n\"content-digest\": sha-256=:sUHrMjQsBZ1gtBzN6hY0J17RIkyWE9GveUwZ09Yz+KU=:\n\"@signature-params\": (\"@authority\";req \"content-digest\");created=1794052200;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794138600;tag=\"http-message-signatures-directory\""
+  },
+  "expected": {
+    "ok": true
+  },
+  "$comment": "Web Bot Auth Appendix B.1: the directory server signs the response once per key, covering \"@authority\";req and content-digest, with created, expires, the key's thumbprint as keyid, and tag http-message-signatures-directory. The verifier validates the signature with the key the directory itself provides and validates Content-Digest against the body. Covering the request authority stops the key set from being served again from another domain."
+}
diff --git a/src/iab_agentic_primitives/web_bot_auth/vectors/positive/003-signed-response.json b/src/iab_agentic_primitives/web_bot_auth/vectors/positive/003-signed-response.json
new file mode 100644
index 0000000..c50a407
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/vectors/positive/003-signed-response.json
@@ -0,0 +1,59 @@
+{
+  "name": "The seller at https://seller.example.com answers the commit with a CommitResult, bound to the signed request",
+  "tier": "wba",
+  "spec": "OpenProposal 3.0 § 2.8",
+  "spec_reference": "https://github.com/IABTechLab/iab-agentic-primitives/blob/main/WEB_BOT_AUTH.md#profile-rules",
+  "signing_profile": "web-bot-auth",
+  "reference_now": 1794052810,
+  "operation": {
+    "op": "verify_response",
+    "request": {
+      "method": "POST",
+      "url": "https://seller.example.com/proposals/prop_7/commit",
+      "headers": [
+        ["Content-Type", "application/json"],
+        ["Content-Digest", "sha-256=:EuXs53uWxD5UR8fAISA74MZj5Zon8wxJPPpMOnOt0qQ=:"],
+        ["Signature-Agent", "sig1=\"https://buyer.example.com/.well-known/http-message-signatures-directory\""],
+        ["Signature-Input", "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\" \"signature-agent\";key=\"sig1\");created=1794052800;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794053100;nonce=\"u3UIzgyJ1lcWwy3bW-sgBjTzto9bC55plCFjW5d7IXTNK8IpYPmaJxCahFuBPx7aaVJQn5S_JCogXc4V9eUAdg\";tag=\"web-bot-auth\""],
+        ["Signature", "sig1=:s5iVKzp/KDKOfXX9nBlU9o4j6ACeNoQnmxu3IcwtkEk1m6b12N1intmAHoig3TqAvevzdP3NCjSgKKtqGd/XBA==:"]
+      ],
+      "body": "{\"entry\":{\"role\":\"commitment\",\"version\":3,\"record_digest\":\"sha256:b88664b8699501cb1b984959d4eb663a2036b223400796f269f8ae4c0762ec9f\",\"line_item_ids\":[\"li_1\"],\"at\":\"2026-11-07T12:00:00Z\",\"idempotency_key\":\"ba1fd8f3-d695-4e8d-8629-ee4073b4f184\"},\"writes\":{\"li_1\":{\"commitment\":{\"flight\":{\"start\":\"2026-12-01T00:00:00Z\",\"end\":\"2026-12-31T23:59:59Z\"}}}}}"
+    },
+    "response": {
+      "status": 200,
+      "headers": [
+        ["Content-Type", "application/json"],
+        ["Content-Digest", "sha-256=:MKVkbVABQlLjWYxMhW/N4sHR9zVovpkWoT/jpzUClTA=:"],
+        ["Signature-Agent", "sig1=\"https://seller.example.com/.well-known/http-message-signatures-directory\""],
+        ["Signature-Input", "sig1=(\"@status\" \"@method\";req \"@target-uri\";req \"content-type\" \"content-digest\" \"signature-agent\";key=\"sig1\" \"signature\";req;key=\"sig1\");created=1794052801;keyid=\"-Rmj_GuEunGbO4x6GQSMCCi0P6oZ32paBkWMnvo3gDU\";alg=\"ed25519\";expires=1794053101;tag=\"web-bot-auth\""],
+        ["Signature", "sig1=:+NDLv087Fl/QxJ4dTUdvj8HhWlqpaqjKWeiFxYHC/4296kyJ7fc/uWwuzPJRFAhTAiGLcQKl8z991CvEg5W7CQ==:"]
+      ],
+      "body": "{\"entries\":[{\"role\":\"commitment\",\"version\":3,\"record_digest\":\"sha256:b88664b8699501cb1b984959d4eb663a2036b223400796f269f8ae4c0762ec9f\",\"line_item_ids\":[\"li_1\"],\"at\":\"2026-11-07T12:00:00Z\",\"idempotency_key\":\"ba1fd8f3-d695-4e8d-8629-ee4073b4f184\"},{\"role\":\"acceptance\",\"version\":3,\"record_digest\":\"sha256:b88664b8699501cb1b984959d4eb663a2036b223400796f269f8ae4c0762ec9f\",\"line_item_ids\":[\"li_1\"],\"at\":\"2026-11-07T12:00:01Z\"}]}"
+    },
+    "directories": {
+      "https://seller.example.com": {
+        "url": "https://seller.example.com/.well-known/http-message-signatures-directory",
+        "status": 200,
+        "headers": [
+          ["Content-Type", "application/http-message-signatures-directory+json"],
+          ["Cache-Control", "max-age=300"],
+          ["Content-Digest", "sha-256=:rdSZr7OiNDjsX5TKvyuh/gdc1lz/tRonWTtqSQECWyc=:"],
+          ["Signature-Input", "key1=(\"@authority\";req \"content-digest\");created=1794052810;keyid=\"-Rmj_GuEunGbO4x6GQSMCCi0P6oZ32paBkWMnvo3gDU\";alg=\"ed25519\";expires=1794139210;tag=\"http-message-signatures-directory\""],
+          ["Signature", "key1=:G1XXn7Y7FKZ4qv0VEvNBnmFFBxQPBTueiocC2WQhQeZ4Qur1aPmF3PDTAkZLdNuysVrCjfz0TGw8A74XV5s0CQ==:"]
+        ],
+        "body": "{\n  \"keys\": [\n    {\n      \"kty\": \"OKP\",\n      \"crv\": \"Ed25519\",\n      \"kid\": \"-Rmj_GuEunGbO4x6GQSMCCi0P6oZ32paBkWMnvo3gDU\",\n      \"x\": \"O2bxA-9_Zieq0cojD3MrpDjUrMla41lwZMGIwmit9IQ\",\n      \"use\": \"sig\"\n    }\n  ]\n}"
+      }
+    },
+    "now": 1794052810,
+    "expected_origin": "https://seller.example.com"
+  },
+  "replay_cache_entries": [],
+  "expected_signature_base": {
+    "sig1": "\"@status\": 200\n\"@method\";req: POST\n\"@target-uri\";req: https://seller.example.com/proposals/prop_7/commit\n\"content-type\": application/json\n\"content-digest\": sha-256=:MKVkbVABQlLjWYxMhW/N4sHR9zVovpkWoT/jpzUClTA=:\n\"signature-agent\";key=\"sig1\": \"https://seller.example.com/.well-known/http-message-signatures-directory\"\n\"signature\";req;key=\"sig1\": :s5iVKzp/KDKOfXX9nBlU9o4j6ACeNoQnmxu3IcwtkEk1m6b12N1intmAHoig3TqAvevzdP3NCjSgKKtqGd/XBA==:\n\"@signature-params\": (\"@status\" \"@method\";req \"@target-uri\";req \"content-type\" \"content-digest\" \"signature-agent\";key=\"sig1\" \"signature\";req;key=\"sig1\");created=1794052801;keyid=\"-Rmj_GuEunGbO4x6GQSMCCi0P6oZ32paBkWMnvo3gDU\";alg=\"ed25519\";expires=1794053101;tag=\"web-bot-auth\""
+  },
+  "expected": {
+    "ok": true,
+    "identity": "https://seller.example.com"
+  },
+  "$comment": "The response covers \"signature\";req;key=\"sig1\", the request's own signature, so it answers that exact request (RFC 9421 section 2.4). It carries no nonce: the binding gives freshness."
+}
diff --git a/src/iab_agentic_primitives/web_bot_auth/vectors/positive/004-origin-form-request.json b/src/iab_agentic_primitives/web_bot_auth/vectors/positive/004-origin-form-request.json
new file mode 100644
index 0000000..e9db63a
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/vectors/positive/004-origin-form-request.json
@@ -0,0 +1,49 @@
+{
+  "name": "Draft -00 form: Signature-Agent names the bare origin https://buyer.example.com",
+  "tier": "wba",
+  "spec": "OpenProposal 3.0 § 2.8",
+  "spec_reference": "https://github.com/IABTechLab/iab-agentic-primitives/blob/main/WEB_BOT_AUTH.md#profile-rules",
+  "signing_profile": "web-bot-auth",
+  "reference_now": 1794052810,
+  "operation": {
+    "op": "verify_request",
+    "request": {
+      "method": "POST",
+      "url": "https://seller.example.com/proposals/prop_7/commit",
+      "headers": [
+        ["Content-Type", "application/json"],
+        ["Content-Digest", "sha-256=:EuXs53uWxD5UR8fAISA74MZj5Zon8wxJPPpMOnOt0qQ=:"],
+        ["Signature-Agent", "sig1=\"https://buyer.example.com\""],
+        ["Signature-Input", "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\" \"signature-agent\";key=\"sig1\");created=1794052800;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794053100;nonce=\"UR3dTpqmGoF5uB58DdVLhHs_32KMPfljOWdsNkOsGxD2jty6F17ak-5O2_tJ9BOwD83NII3f9kcb0wY-WYDyqA\";tag=\"web-bot-auth\""],
+        ["Signature", "sig1=:/1KhDP6Qjlt11tE/PyYNSYVCBeSz8WyqxMjQbzd6djlzs2Gj1erV1HWGPGAGNt/kOPCzNWUjEV5jvEtiz7vFAQ==:"]
+      ],
+      "body": "{\"entry\":{\"role\":\"commitment\",\"version\":3,\"record_digest\":\"sha256:b88664b8699501cb1b984959d4eb663a2036b223400796f269f8ae4c0762ec9f\",\"line_item_ids\":[\"li_1\"],\"at\":\"2026-11-07T12:00:00Z\",\"idempotency_key\":\"ba1fd8f3-d695-4e8d-8629-ee4073b4f184\"},\"writes\":{\"li_1\":{\"commitment\":{\"flight\":{\"start\":\"2026-12-01T00:00:00Z\",\"end\":\"2026-12-31T23:59:59Z\"}}}}}"
+    },
+    "authority": "seller.example.com",
+    "directories": {
+      "https://buyer.example.com": {
+        "url": "https://buyer.example.com/.well-known/http-message-signatures-directory",
+        "status": 200,
+        "headers": [
+          ["Content-Type", "application/http-message-signatures-directory+json"],
+          ["Cache-Control", "max-age=300"],
+          ["Content-Digest", "sha-256=:sUHrMjQsBZ1gtBzN6hY0J17RIkyWE9GveUwZ09Yz+KU=:"],
+          ["Signature-Input", "key1=(\"@authority\";req \"content-digest\");created=1794052810;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794139210;tag=\"http-message-signatures-directory\""],
+          ["Signature", "key1=:0Bb3wTK5UolNusnjC2jMXxuBGXChENGXKt4OfXRjaWZm+qiRMriBCWrY4WFbsn+GrCOC0OpVrayNRIgcmsEqBw==:"]
+        ],
+        "body": "{\n  \"keys\": [\n    {\n      \"kty\": \"OKP\",\n      \"crv\": \"Ed25519\",\n      \"kid\": \"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\",\n      \"x\": \"eaZpKteR6m0v7GQPeK0Hv4B0DdvqI99SsTPztodAE5w\",\n      \"use\": \"sig\"\n    }\n  ]\n}"
+      }
+    },
+    "now": 1794052810,
+    "prior": []
+  },
+  "replay_cache_entries": [],
+  "expected_signature_base": {
+    "sig1": "\"@method\": POST\n\"@target-uri\": https://seller.example.com/proposals/prop_7/commit\n\"@authority\": seller.example.com\n\"content-type\": application/json\n\"content-digest\": sha-256=:EuXs53uWxD5UR8fAISA74MZj5Zon8wxJPPpMOnOt0qQ=:\n\"signature-agent\";key=\"sig1\": \"https://buyer.example.com\"\n\"@signature-params\": (\"@method\" \"@target-uri\" \"@authority\" \"content-type\" \"content-digest\" \"signature-agent\";key=\"sig1\");created=1794052800;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794053100;nonce=\"UR3dTpqmGoF5uB58DdVLhHs_32KMPfljOWdsNkOsGxD2jty6F17ak-5O2_tJ9BOwD83NII3f9kcb0wY-WYDyqA\";tag=\"web-bot-auth\""
+  },
+  "expected": {
+    "ok": true,
+    "identity": "https://buyer.example.com"
+  },
+  "$comment": "A draft -00 signer names its origin. The verifier constructs https://buyer.example.com/.well-known/http-message-signatures-directory, the same URL a key URL member names, fetches it, and attributes the request to the same origin."
+}
diff --git a/src/iab_agentic_primitives/web_bot_auth/vectors/positive/005-target-uri-array-brackets.json b/src/iab_agentic_primitives/web_bot_auth/vectors/positive/005-target-uri-array-brackets.json
new file mode 100644
index 0000000..5153ca3
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/vectors/positive/005-target-uri-array-brackets.json
@@ -0,0 +1,47 @@
+{
+  "name": "@target-uri: array brackets in the query, https://seller.example.com/proposals?ids[]=1",
+  "tier": "wba",
+  "spec": "OpenProposal 3.0 § 2.8",
+  "spec_reference": "https://github.com/IABTechLab/iab-agentic-primitives/blob/main/WEB_BOT_AUTH.md#the-target-uri",
+  "signing_profile": "web-bot-auth",
+  "reference_now": 1794052810,
+  "operation": {
+    "op": "verify_request",
+    "request": {
+      "method": "GET",
+      "url": "https://seller.example.com/proposals?ids[]=1",
+      "headers": [
+        ["Signature-Agent", "sig1=\"https://buyer.example.com/.well-known/http-message-signatures-directory\""],
+        ["Signature-Input", "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"signature-agent\";key=\"sig1\");created=1794052800;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794053100;nonce=\"nAnSEE3T86KlTwMfCBOmI-93Q8neWVQRe_Ygt4yfqAFoCQn7uofOxv_b4eOe_4zYQbaznvFCeH698OlftMMdeg\";tag=\"web-bot-auth\""],
+        ["Signature", "sig1=:ReEGCt72gszyUQY4ppLnc+5SAk9jnIUZmhv+LfAg9aJUHnstIPPcv+9iMrpGNAYWQPgcLfzWux0sW9087qVvCQ==:"]
+      ],
+      "body": ""
+    },
+    "authority": "seller.example.com",
+    "directories": {
+      "https://buyer.example.com": {
+        "url": "https://buyer.example.com/.well-known/http-message-signatures-directory",
+        "status": 200,
+        "headers": [
+          ["Content-Type", "application/http-message-signatures-directory+json"],
+          ["Cache-Control", "max-age=300"],
+          ["Content-Digest", "sha-256=:sUHrMjQsBZ1gtBzN6hY0J17RIkyWE9GveUwZ09Yz+KU=:"],
+          ["Signature-Input", "key1=(\"@authority\";req \"content-digest\");created=1794052810;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794139210;tag=\"http-message-signatures-directory\""],
+          ["Signature", "key1=:0Bb3wTK5UolNusnjC2jMXxuBGXChENGXKt4OfXRjaWZm+qiRMriBCWrY4WFbsn+GrCOC0OpVrayNRIgcmsEqBw==:"]
+        ],
+        "body": "{\n  \"keys\": [\n    {\n      \"kty\": \"OKP\",\n      \"crv\": \"Ed25519\",\n      \"kid\": \"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\",\n      \"x\": \"eaZpKteR6m0v7GQPeK0Hv4B0DdvqI99SsTPztodAE5w\",\n      \"use\": \"sig\"\n    }\n  ]\n}"
+      }
+    },
+    "now": 1794052810,
+    "prior": []
+  },
+  "replay_cache_entries": [],
+  "expected_signature_base": {
+    "sig1": "\"@method\": GET\n\"@target-uri\": https://seller.example.com/proposals?ids[]=1\n\"@authority\": seller.example.com\n\"signature-agent\";key=\"sig1\": \"https://buyer.example.com/.well-known/http-message-signatures-directory\"\n\"@signature-params\": (\"@method\" \"@target-uri\" \"@authority\" \"signature-agent\";key=\"sig1\");created=1794052800;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794053100;nonce=\"nAnSEE3T86KlTwMfCBOmI-93Q8neWVQRe_Ygt4yfqAFoCQn7uofOxv_b4eOe_4zYQbaznvFCeH698OlftMMdeg\";tag=\"web-bot-auth\""
+  },
+  "expected": {
+    "ok": true,
+    "identity": "https://buyer.example.com"
+  },
+  "$comment": "The buyer signs a GET to https://seller.example.com/proposals?ids[]=1, and the request carries that URL as a caller writes it. Its @target-uri is https://seller.example.com/proposals?ids[]=1: the URL as an HTTP client sends it and a server receives it, the WHATWG URL serialization normalized per RFC 3986 section 6.2.2 (lowercase scheme and host, no default port, no dot segments), with every character a client sends raw left as written. A verifier that parses the URL with a stricter grammar, re-encodes it, or skips the normalization computes another signature base and refuses a valid request."
+}
diff --git a/src/iab_agentic_primitives/web_bot_auth/vectors/positive/006-target-uri-pipe.json b/src/iab_agentic_primitives/web_bot_auth/vectors/positive/006-target-uri-pipe.json
new file mode 100644
index 0000000..f341021
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/vectors/positive/006-target-uri-pipe.json
@@ -0,0 +1,47 @@
+{
+  "name": "@target-uri: a pipe in the query, https://seller.example.com/proposals?f=a|b",
+  "tier": "wba",
+  "spec": "OpenProposal 3.0 § 2.8",
+  "spec_reference": "https://github.com/IABTechLab/iab-agentic-primitives/blob/main/WEB_BOT_AUTH.md#the-target-uri",
+  "signing_profile": "web-bot-auth",
+  "reference_now": 1794052810,
+  "operation": {
+    "op": "verify_request",
+    "request": {
+      "method": "GET",
+      "url": "https://seller.example.com/proposals?f=a|b",
+      "headers": [
+        ["Signature-Agent", "sig1=\"https://buyer.example.com/.well-known/http-message-signatures-directory\""],
+        ["Signature-Input", "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"signature-agent\";key=\"sig1\");created=1794052800;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794053100;nonce=\"XnqdBaptIrIEE59mSw7LEY_thb0ovc4p1UNBZU8_tT_It8TDDKLUnSaLv3mp8X6IaLrxUSM-9thYl2hvAgJ1yw\";tag=\"web-bot-auth\""],
+        ["Signature", "sig1=:W3H06f47eKXQXXmf/et0NbKRIagd7YpqeDEGe1gFfZ0n0PMt/srx897JNyt9WvoCsn694K/XjjyIHfjThdfqAg==:"]
+      ],
+      "body": ""
+    },
+    "authority": "seller.example.com",
+    "directories": {
+      "https://buyer.example.com": {
+        "url": "https://buyer.example.com/.well-known/http-message-signatures-directory",
+        "status": 200,
+        "headers": [
+          ["Content-Type", "application/http-message-signatures-directory+json"],
+          ["Cache-Control", "max-age=300"],
+          ["Content-Digest", "sha-256=:sUHrMjQsBZ1gtBzN6hY0J17RIkyWE9GveUwZ09Yz+KU=:"],
+          ["Signature-Input", "key1=(\"@authority\";req \"content-digest\");created=1794052810;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794139210;tag=\"http-message-signatures-directory\""],
+          ["Signature", "key1=:0Bb3wTK5UolNusnjC2jMXxuBGXChENGXKt4OfXRjaWZm+qiRMriBCWrY4WFbsn+GrCOC0OpVrayNRIgcmsEqBw==:"]
+        ],
+        "body": "{\n  \"keys\": [\n    {\n      \"kty\": \"OKP\",\n      \"crv\": \"Ed25519\",\n      \"kid\": \"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\",\n      \"x\": \"eaZpKteR6m0v7GQPeK0Hv4B0DdvqI99SsTPztodAE5w\",\n      \"use\": \"sig\"\n    }\n  ]\n}"
+      }
+    },
+    "now": 1794052810,
+    "prior": []
+  },
+  "replay_cache_entries": [],
+  "expected_signature_base": {
+    "sig1": "\"@method\": GET\n\"@target-uri\": https://seller.example.com/proposals?f=a|b\n\"@authority\": seller.example.com\n\"signature-agent\";key=\"sig1\": \"https://buyer.example.com/.well-known/http-message-signatures-directory\"\n\"@signature-params\": (\"@method\" \"@target-uri\" \"@authority\" \"signature-agent\";key=\"sig1\");created=1794052800;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794053100;nonce=\"XnqdBaptIrIEE59mSw7LEY_thb0ovc4p1UNBZU8_tT_It8TDDKLUnSaLv3mp8X6IaLrxUSM-9thYl2hvAgJ1yw\";tag=\"web-bot-auth\""
+  },
+  "expected": {
+    "ok": true,
+    "identity": "https://buyer.example.com"
+  },
+  "$comment": "The buyer signs a GET to https://seller.example.com/proposals?f=a|b, and the request carries that URL as a caller writes it. Its @target-uri is https://seller.example.com/proposals?f=a|b: the URL as an HTTP client sends it and a server receives it, the WHATWG URL serialization normalized per RFC 3986 section 6.2.2 (lowercase scheme and host, no default port, no dot segments), with every character a client sends raw left as written. A verifier that parses the URL with a stricter grammar, re-encodes it, or skips the normalization computes another signature base and refuses a valid request."
+}
diff --git a/src/iab_agentic_primitives/web_bot_auth/vectors/positive/007-target-uri-braces.json b/src/iab_agentic_primitives/web_bot_auth/vectors/positive/007-target-uri-braces.json
new file mode 100644
index 0000000..89d0e30
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/vectors/positive/007-target-uri-braces.json
@@ -0,0 +1,47 @@
+{
+  "name": "@target-uri: braces in the query, https://seller.example.com/proposals?q={json}",
+  "tier": "wba",
+  "spec": "OpenProposal 3.0 § 2.8",
+  "spec_reference": "https://github.com/IABTechLab/iab-agentic-primitives/blob/main/WEB_BOT_AUTH.md#the-target-uri",
+  "signing_profile": "web-bot-auth",
+  "reference_now": 1794052810,
+  "operation": {
+    "op": "verify_request",
+    "request": {
+      "method": "GET",
+      "url": "https://seller.example.com/proposals?q={json}",
+      "headers": [
+        ["Signature-Agent", "sig1=\"https://buyer.example.com/.well-known/http-message-signatures-directory\""],
+        ["Signature-Input", "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"signature-agent\";key=\"sig1\");created=1794052800;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794053100;nonce=\"Tybam_hjkTKBzhEGfhFxjod4d3DfGrNhwKaiBt2vmU5c9JgMVhU3-jVgZ7c180zJEYAevasfQF5NC2iykeAuJQ\";tag=\"web-bot-auth\""],
+        ["Signature", "sig1=:ZlSZsfN7ewfe8aWs0aAwwicEPgW6tjp7Me2FavGVyjI1znJeeoBrgSV5LGlpsTvJtTGL3AxQM0AD2E7MwXAFAQ==:"]
+      ],
+      "body": ""
+    },
+    "authority": "seller.example.com",
+    "directories": {
+      "https://buyer.example.com": {
+        "url": "https://buyer.example.com/.well-known/http-message-signatures-directory",
+        "status": 200,
+        "headers": [
+          ["Content-Type", "application/http-message-signatures-directory+json"],
+          ["Cache-Control", "max-age=300"],
+          ["Content-Digest", "sha-256=:sUHrMjQsBZ1gtBzN6hY0J17RIkyWE9GveUwZ09Yz+KU=:"],
+          ["Signature-Input", "key1=(\"@authority\";req \"content-digest\");created=1794052810;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794139210;tag=\"http-message-signatures-directory\""],
+          ["Signature", "key1=:0Bb3wTK5UolNusnjC2jMXxuBGXChENGXKt4OfXRjaWZm+qiRMriBCWrY4WFbsn+GrCOC0OpVrayNRIgcmsEqBw==:"]
+        ],
+        "body": "{\n  \"keys\": [\n    {\n      \"kty\": \"OKP\",\n      \"crv\": \"Ed25519\",\n      \"kid\": \"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\",\n      \"x\": \"eaZpKteR6m0v7GQPeK0Hv4B0DdvqI99SsTPztodAE5w\",\n      \"use\": \"sig\"\n    }\n  ]\n}"
+      }
+    },
+    "now": 1794052810,
+    "prior": []
+  },
+  "replay_cache_entries": [],
+  "expected_signature_base": {
+    "sig1": "\"@method\": GET\n\"@target-uri\": https://seller.example.com/proposals?q={json}\n\"@authority\": seller.example.com\n\"signature-agent\";key=\"sig1\": \"https://buyer.example.com/.well-known/http-message-signatures-directory\"\n\"@signature-params\": (\"@method\" \"@target-uri\" \"@authority\" \"signature-agent\";key=\"sig1\");created=1794052800;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794053100;nonce=\"Tybam_hjkTKBzhEGfhFxjod4d3DfGrNhwKaiBt2vmU5c9JgMVhU3-jVgZ7c180zJEYAevasfQF5NC2iykeAuJQ\";tag=\"web-bot-auth\""
+  },
+  "expected": {
+    "ok": true,
+    "identity": "https://buyer.example.com"
+  },
+  "$comment": "The buyer signs a GET to https://seller.example.com/proposals?q={json}, and the request carries that URL as a caller writes it. Its @target-uri is https://seller.example.com/proposals?q={json}: the URL as an HTTP client sends it and a server receives it, the WHATWG URL serialization normalized per RFC 3986 section 6.2.2 (lowercase scheme and host, no default port, no dot segments), with every character a client sends raw left as written. A verifier that parses the URL with a stricter grammar, re-encodes it, or skips the normalization computes another signature base and refuses a valid request."
+}
diff --git a/src/iab_agentic_primitives/web_bot_auth/vectors/positive/008-target-uri-caret.json b/src/iab_agentic_primitives/web_bot_auth/vectors/positive/008-target-uri-caret.json
new file mode 100644
index 0000000..305f76e
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/vectors/positive/008-target-uri-caret.json
@@ -0,0 +1,47 @@
+{
+  "name": "@target-uri: a caret in the query, https://seller.example.com/proposals?q=a^b",
+  "tier": "wba",
+  "spec": "OpenProposal 3.0 § 2.8",
+  "spec_reference": "https://github.com/IABTechLab/iab-agentic-primitives/blob/main/WEB_BOT_AUTH.md#the-target-uri",
+  "signing_profile": "web-bot-auth",
+  "reference_now": 1794052810,
+  "operation": {
+    "op": "verify_request",
+    "request": {
+      "method": "GET",
+      "url": "https://seller.example.com/proposals?q=a^b",
+      "headers": [
+        ["Signature-Agent", "sig1=\"https://buyer.example.com/.well-known/http-message-signatures-directory\""],
+        ["Signature-Input", "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"signature-agent\";key=\"sig1\");created=1794052800;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794053100;nonce=\"O7NUXYRIZ57GWEEEV2__yf2PaJPffFf7M809ByScgQ5B_SJAiwnYHnkxeulCSIqqLHyqkPkG4vgGxeIhBC4stw\";tag=\"web-bot-auth\""],
+        ["Signature", "sig1=:yGkK3gqLguU5l0U0flrvNT8wMHTKrEYYpCI+/TxLwCEYSZ4N0G9FIU0KomAc/W+Qh5AwUmxZPfRKRW7nNHR0CA==:"]
+      ],
+      "body": ""
+    },
+    "authority": "seller.example.com",
+    "directories": {
+      "https://buyer.example.com": {
+        "url": "https://buyer.example.com/.well-known/http-message-signatures-directory",
+        "status": 200,
+        "headers": [
+          ["Content-Type", "application/http-message-signatures-directory+json"],
+          ["Cache-Control", "max-age=300"],
+          ["Content-Digest", "sha-256=:sUHrMjQsBZ1gtBzN6hY0J17RIkyWE9GveUwZ09Yz+KU=:"],
+          ["Signature-Input", "key1=(\"@authority\";req \"content-digest\");created=1794052810;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794139210;tag=\"http-message-signatures-directory\""],
+          ["Signature", "key1=:0Bb3wTK5UolNusnjC2jMXxuBGXChENGXKt4OfXRjaWZm+qiRMriBCWrY4WFbsn+GrCOC0OpVrayNRIgcmsEqBw==:"]
+        ],
+        "body": "{\n  \"keys\": [\n    {\n      \"kty\": \"OKP\",\n      \"crv\": \"Ed25519\",\n      \"kid\": \"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\",\n      \"x\": \"eaZpKteR6m0v7GQPeK0Hv4B0DdvqI99SsTPztodAE5w\",\n      \"use\": \"sig\"\n    }\n  ]\n}"
+      }
+    },
+    "now": 1794052810,
+    "prior": []
+  },
+  "replay_cache_entries": [],
+  "expected_signature_base": {
+    "sig1": "\"@method\": GET\n\"@target-uri\": https://seller.example.com/proposals?q=a^b\n\"@authority\": seller.example.com\n\"signature-agent\";key=\"sig1\": \"https://buyer.example.com/.well-known/http-message-signatures-directory\"\n\"@signature-params\": (\"@method\" \"@target-uri\" \"@authority\" \"signature-agent\";key=\"sig1\");created=1794052800;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794053100;nonce=\"O7NUXYRIZ57GWEEEV2__yf2PaJPffFf7M809ByScgQ5B_SJAiwnYHnkxeulCSIqqLHyqkPkG4vgGxeIhBC4stw\";tag=\"web-bot-auth\""
+  },
+  "expected": {
+    "ok": true,
+    "identity": "https://buyer.example.com"
+  },
+  "$comment": "The buyer signs a GET to https://seller.example.com/proposals?q=a^b, and the request carries that URL as a caller writes it. Its @target-uri is https://seller.example.com/proposals?q=a^b: the URL as an HTTP client sends it and a server receives it, the WHATWG URL serialization normalized per RFC 3986 section 6.2.2 (lowercase scheme and host, no default port, no dot segments), with every character a client sends raw left as written. A verifier that parses the URL with a stricter grammar, re-encodes it, or skips the normalization computes another signature base and refuses a valid request."
+}
diff --git a/src/iab_agentic_primitives/web_bot_auth/vectors/positive/009-target-uri-escaped-space.json b/src/iab_agentic_primitives/web_bot_auth/vectors/positive/009-target-uri-escaped-space.json
new file mode 100644
index 0000000..d0ab02c
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/vectors/positive/009-target-uri-escaped-space.json
@@ -0,0 +1,47 @@
+{
+  "name": "@target-uri: an escaped space in the path, https://seller.example.com/proposals/a%20b",
+  "tier": "wba",
+  "spec": "OpenProposal 3.0 § 2.8",
+  "spec_reference": "https://github.com/IABTechLab/iab-agentic-primitives/blob/main/WEB_BOT_AUTH.md#the-target-uri",
+  "signing_profile": "web-bot-auth",
+  "reference_now": 1794052810,
+  "operation": {
+    "op": "verify_request",
+    "request": {
+      "method": "GET",
+      "url": "https://seller.example.com/proposals/a%20b",
+      "headers": [
+        ["Signature-Agent", "sig1=\"https://buyer.example.com/.well-known/http-message-signatures-directory\""],
+        ["Signature-Input", "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"signature-agent\";key=\"sig1\");created=1794052800;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794053100;nonce=\"Yq4xENIv21Kz4aslVCoJ9aKYVlzuVSchD_q2A8c-7Pi1VltV2pSv2AO12yP4iML-a-GHvAqqFRp7dyGP2smGJQ\";tag=\"web-bot-auth\""],
+        ["Signature", "sig1=:YLxWORn9nXmGWe+Jq0EKAq8Hqm7m8gIBNuW+ufk9rqg2eGsG6EcbCadBVMyc33Xf0rHK2JTFtU5h5JIsgfseDQ==:"]
+      ],
+      "body": ""
+    },
+    "authority": "seller.example.com",
+    "directories": {
+      "https://buyer.example.com": {
+        "url": "https://buyer.example.com/.well-known/http-message-signatures-directory",
+        "status": 200,
+        "headers": [
+          ["Content-Type", "application/http-message-signatures-directory+json"],
+          ["Cache-Control", "max-age=300"],
+          ["Content-Digest", "sha-256=:sUHrMjQsBZ1gtBzN6hY0J17RIkyWE9GveUwZ09Yz+KU=:"],
+          ["Signature-Input", "key1=(\"@authority\";req \"content-digest\");created=1794052810;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794139210;tag=\"http-message-signatures-directory\""],
+          ["Signature", "key1=:0Bb3wTK5UolNusnjC2jMXxuBGXChENGXKt4OfXRjaWZm+qiRMriBCWrY4WFbsn+GrCOC0OpVrayNRIgcmsEqBw==:"]
+        ],
+        "body": "{\n  \"keys\": [\n    {\n      \"kty\": \"OKP\",\n      \"crv\": \"Ed25519\",\n      \"kid\": \"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\",\n      \"x\": \"eaZpKteR6m0v7GQPeK0Hv4B0DdvqI99SsTPztodAE5w\",\n      \"use\": \"sig\"\n    }\n  ]\n}"
+      }
+    },
+    "now": 1794052810,
+    "prior": []
+  },
+  "replay_cache_entries": [],
+  "expected_signature_base": {
+    "sig1": "\"@method\": GET\n\"@target-uri\": https://seller.example.com/proposals/a%20b\n\"@authority\": seller.example.com\n\"signature-agent\";key=\"sig1\": \"https://buyer.example.com/.well-known/http-message-signatures-directory\"\n\"@signature-params\": (\"@method\" \"@target-uri\" \"@authority\" \"signature-agent\";key=\"sig1\");created=1794052800;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794053100;nonce=\"Yq4xENIv21Kz4aslVCoJ9aKYVlzuVSchD_q2A8c-7Pi1VltV2pSv2AO12yP4iML-a-GHvAqqFRp7dyGP2smGJQ\";tag=\"web-bot-auth\""
+  },
+  "expected": {
+    "ok": true,
+    "identity": "https://buyer.example.com"
+  },
+  "$comment": "The buyer signs a GET to https://seller.example.com/proposals/a%20b, and the request carries that URL as a caller writes it. Its @target-uri is https://seller.example.com/proposals/a%20b: the URL as an HTTP client sends it and a server receives it, the WHATWG URL serialization normalized per RFC 3986 section 6.2.2 (lowercase scheme and host, no default port, no dot segments), with every character a client sends raw left as written. A verifier that parses the URL with a stricter grammar, re-encodes it, or skips the normalization computes another signature base and refuses a valid request."
+}
diff --git a/src/iab_agentic_primitives/web_bot_auth/vectors/positive/010-target-uri-default-port.json b/src/iab_agentic_primitives/web_bot_auth/vectors/positive/010-target-uri-default-port.json
new file mode 100644
index 0000000..4b9efdc
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/vectors/positive/010-target-uri-default-port.json
@@ -0,0 +1,47 @@
+{
+  "name": "@target-uri: the default port, https://seller.example.com:443/proposals/prop_7",
+  "tier": "wba",
+  "spec": "OpenProposal 3.0 § 2.8",
+  "spec_reference": "https://github.com/IABTechLab/iab-agentic-primitives/blob/main/WEB_BOT_AUTH.md#the-target-uri",
+  "signing_profile": "web-bot-auth",
+  "reference_now": 1794052810,
+  "operation": {
+    "op": "verify_request",
+    "request": {
+      "method": "GET",
+      "url": "https://seller.example.com:443/proposals/prop_7",
+      "headers": [
+        ["Signature-Agent", "sig1=\"https://buyer.example.com/.well-known/http-message-signatures-directory\""],
+        ["Signature-Input", "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"signature-agent\";key=\"sig1\");created=1794052800;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794053100;nonce=\"VFPBT0myd-FMGYcfumeczokUeUxSkJzH0MPgeYoaiMmmyvAvIf5h8agOiM9gxqhvVjBfwN0Oqo7V4yVB7Fc0sQ\";tag=\"web-bot-auth\""],
+        ["Signature", "sig1=:VnEf1x/dPWTMakyWUObFIsBNR7Z2nKtNQ/TusBnxDHwDxq+8S8qfPx1R8wjrFIjSdY9J6jUuE/I94Wbg2n2aCQ==:"]
+      ],
+      "body": ""
+    },
+    "authority": "seller.example.com",
+    "directories": {
+      "https://buyer.example.com": {
+        "url": "https://buyer.example.com/.well-known/http-message-signatures-directory",
+        "status": 200,
+        "headers": [
+          ["Content-Type", "application/http-message-signatures-directory+json"],
+          ["Cache-Control", "max-age=300"],
+          ["Content-Digest", "sha-256=:sUHrMjQsBZ1gtBzN6hY0J17RIkyWE9GveUwZ09Yz+KU=:"],
+          ["Signature-Input", "key1=(\"@authority\";req \"content-digest\");created=1794052810;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794139210;tag=\"http-message-signatures-directory\""],
+          ["Signature", "key1=:0Bb3wTK5UolNusnjC2jMXxuBGXChENGXKt4OfXRjaWZm+qiRMriBCWrY4WFbsn+GrCOC0OpVrayNRIgcmsEqBw==:"]
+        ],
+        "body": "{\n  \"keys\": [\n    {\n      \"kty\": \"OKP\",\n      \"crv\": \"Ed25519\",\n      \"kid\": \"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\",\n      \"x\": \"eaZpKteR6m0v7GQPeK0Hv4B0DdvqI99SsTPztodAE5w\",\n      \"use\": \"sig\"\n    }\n  ]\n}"
+      }
+    },
+    "now": 1794052810,
+    "prior": []
+  },
+  "replay_cache_entries": [],
+  "expected_signature_base": {
+    "sig1": "\"@method\": GET\n\"@target-uri\": https://seller.example.com/proposals/prop_7\n\"@authority\": seller.example.com\n\"signature-agent\";key=\"sig1\": \"https://buyer.example.com/.well-known/http-message-signatures-directory\"\n\"@signature-params\": (\"@method\" \"@target-uri\" \"@authority\" \"signature-agent\";key=\"sig1\");created=1794052800;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794053100;nonce=\"VFPBT0myd-FMGYcfumeczokUeUxSkJzH0MPgeYoaiMmmyvAvIf5h8agOiM9gxqhvVjBfwN0Oqo7V4yVB7Fc0sQ\";tag=\"web-bot-auth\""
+  },
+  "expected": {
+    "ok": true,
+    "identity": "https://buyer.example.com"
+  },
+  "$comment": "The buyer signs a GET to https://seller.example.com:443/proposals/prop_7, and the request carries that URL as a caller writes it. Its @target-uri is https://seller.example.com/proposals/prop_7: the URL as an HTTP client sends it and a server receives it, the WHATWG URL serialization normalized per RFC 3986 section 6.2.2 (lowercase scheme and host, no default port, no dot segments), with every character a client sends raw left as written. A verifier that parses the URL with a stricter grammar, re-encodes it, or skips the normalization computes another signature base and refuses a valid request."
+}
diff --git a/src/iab_agentic_primitives/web_bot_auth/vectors/positive/011-target-uri-mixed-case.json b/src/iab_agentic_primitives/web_bot_auth/vectors/positive/011-target-uri-mixed-case.json
new file mode 100644
index 0000000..3e34ef8
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/vectors/positive/011-target-uri-mixed-case.json
@@ -0,0 +1,47 @@
+{
+  "name": "@target-uri: a mixed-case scheme and host, HTTPS://Seller.Example.COM/proposals/prop_7",
+  "tier": "wba",
+  "spec": "OpenProposal 3.0 § 2.8",
+  "spec_reference": "https://github.com/IABTechLab/iab-agentic-primitives/blob/main/WEB_BOT_AUTH.md#the-target-uri",
+  "signing_profile": "web-bot-auth",
+  "reference_now": 1794052810,
+  "operation": {
+    "op": "verify_request",
+    "request": {
+      "method": "GET",
+      "url": "HTTPS://Seller.Example.COM/proposals/prop_7",
+      "headers": [
+        ["Signature-Agent", "sig1=\"https://buyer.example.com/.well-known/http-message-signatures-directory\""],
+        ["Signature-Input", "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"signature-agent\";key=\"sig1\");created=1794052800;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794053100;nonce=\"N7bsZGmdkK--aBon-QPdH57WlA3WKDreECS2x_ivp73GqBEssfAfk84kmW2H3__LDNkaX8M_D2rn-dFXNLtPJw\";tag=\"web-bot-auth\""],
+        ["Signature", "sig1=:Ke16vX2J2TkKkWhw0nZprZ41KUyU9UBpeNZYGbDRHYsmxBHpahPv2VX79yw1ojztT0zd1seb7T3GlItxwj4ZDw==:"]
+      ],
+      "body": ""
+    },
+    "authority": "seller.example.com",
+    "directories": {
+      "https://buyer.example.com": {
+        "url": "https://buyer.example.com/.well-known/http-message-signatures-directory",
+        "status": 200,
+        "headers": [
+          ["Content-Type", "application/http-message-signatures-directory+json"],
+          ["Cache-Control", "max-age=300"],
+          ["Content-Digest", "sha-256=:sUHrMjQsBZ1gtBzN6hY0J17RIkyWE9GveUwZ09Yz+KU=:"],
+          ["Signature-Input", "key1=(\"@authority\";req \"content-digest\");created=1794052810;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794139210;tag=\"http-message-signatures-directory\""],
+          ["Signature", "key1=:0Bb3wTK5UolNusnjC2jMXxuBGXChENGXKt4OfXRjaWZm+qiRMriBCWrY4WFbsn+GrCOC0OpVrayNRIgcmsEqBw==:"]
+        ],
+        "body": "{\n  \"keys\": [\n    {\n      \"kty\": \"OKP\",\n      \"crv\": \"Ed25519\",\n      \"kid\": \"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\",\n      \"x\": \"eaZpKteR6m0v7GQPeK0Hv4B0DdvqI99SsTPztodAE5w\",\n      \"use\": \"sig\"\n    }\n  ]\n}"
+      }
+    },
+    "now": 1794052810,
+    "prior": []
+  },
+  "replay_cache_entries": [],
+  "expected_signature_base": {
+    "sig1": "\"@method\": GET\n\"@target-uri\": https://seller.example.com/proposals/prop_7\n\"@authority\": seller.example.com\n\"signature-agent\";key=\"sig1\": \"https://buyer.example.com/.well-known/http-message-signatures-directory\"\n\"@signature-params\": (\"@method\" \"@target-uri\" \"@authority\" \"signature-agent\";key=\"sig1\");created=1794052800;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794053100;nonce=\"N7bsZGmdkK--aBon-QPdH57WlA3WKDreECS2x_ivp73GqBEssfAfk84kmW2H3__LDNkaX8M_D2rn-dFXNLtPJw\";tag=\"web-bot-auth\""
+  },
+  "expected": {
+    "ok": true,
+    "identity": "https://buyer.example.com"
+  },
+  "$comment": "The buyer signs a GET to HTTPS://Seller.Example.COM/proposals/prop_7, and the request carries that URL as a caller writes it. Its @target-uri is https://seller.example.com/proposals/prop_7: the URL as an HTTP client sends it and a server receives it, the WHATWG URL serialization normalized per RFC 3986 section 6.2.2 (lowercase scheme and host, no default port, no dot segments), with every character a client sends raw left as written. A verifier that parses the URL with a stricter grammar, re-encodes it, or skips the normalization computes another signature base and refuses a valid request."
+}
diff --git a/src/iab_agentic_primitives/web_bot_auth/vectors/positive/012-target-uri-dot-segments.json b/src/iab_agentic_primitives/web_bot_auth/vectors/positive/012-target-uri-dot-segments.json
new file mode 100644
index 0000000..c011b62
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/vectors/positive/012-target-uri-dot-segments.json
@@ -0,0 +1,47 @@
+{
+  "name": "@target-uri: dot segments in the path, https://seller.example.com/proposals/./x/../prop_7",
+  "tier": "wba",
+  "spec": "OpenProposal 3.0 § 2.8",
+  "spec_reference": "https://github.com/IABTechLab/iab-agentic-primitives/blob/main/WEB_BOT_AUTH.md#the-target-uri",
+  "signing_profile": "web-bot-auth",
+  "reference_now": 1794052810,
+  "operation": {
+    "op": "verify_request",
+    "request": {
+      "method": "GET",
+      "url": "https://seller.example.com/proposals/./x/../prop_7",
+      "headers": [
+        ["Signature-Agent", "sig1=\"https://buyer.example.com/.well-known/http-message-signatures-directory\""],
+        ["Signature-Input", "sig1=(\"@method\" \"@target-uri\" \"@authority\" \"signature-agent\";key=\"sig1\");created=1794052800;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794053100;nonce=\"4KEQ-LSY-Jq72KZyaM8KZdJRyCc2osqJKrADiN3MGC5UFaccZaE3ldMv_cFy55cKrl1bkKLi6hx3PrUIte6YCQ\";tag=\"web-bot-auth\""],
+        ["Signature", "sig1=:DUHPmtBKocuTgy/aagSdmXG+T9JPy51BUfAc7r37Mlzvz3xkycJgYs6OSO8Z973hnX1EAoVmf3Hh1BcQWq3pBw==:"]
+      ],
+      "body": ""
+    },
+    "authority": "seller.example.com",
+    "directories": {
+      "https://buyer.example.com": {
+        "url": "https://buyer.example.com/.well-known/http-message-signatures-directory",
+        "status": 200,
+        "headers": [
+          ["Content-Type", "application/http-message-signatures-directory+json"],
+          ["Cache-Control", "max-age=300"],
+          ["Content-Digest", "sha-256=:sUHrMjQsBZ1gtBzN6hY0J17RIkyWE9GveUwZ09Yz+KU=:"],
+          ["Signature-Input", "key1=(\"@authority\";req \"content-digest\");created=1794052810;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794139210;tag=\"http-message-signatures-directory\""],
+          ["Signature", "key1=:0Bb3wTK5UolNusnjC2jMXxuBGXChENGXKt4OfXRjaWZm+qiRMriBCWrY4WFbsn+GrCOC0OpVrayNRIgcmsEqBw==:"]
+        ],
+        "body": "{\n  \"keys\": [\n    {\n      \"kty\": \"OKP\",\n      \"crv\": \"Ed25519\",\n      \"kid\": \"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\",\n      \"x\": \"eaZpKteR6m0v7GQPeK0Hv4B0DdvqI99SsTPztodAE5w\",\n      \"use\": \"sig\"\n    }\n  ]\n}"
+      }
+    },
+    "now": 1794052810,
+    "prior": []
+  },
+  "replay_cache_entries": [],
+  "expected_signature_base": {
+    "sig1": "\"@method\": GET\n\"@target-uri\": https://seller.example.com/proposals/prop_7\n\"@authority\": seller.example.com\n\"signature-agent\";key=\"sig1\": \"https://buyer.example.com/.well-known/http-message-signatures-directory\"\n\"@signature-params\": (\"@method\" \"@target-uri\" \"@authority\" \"signature-agent\";key=\"sig1\");created=1794052800;keyid=\"T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84\";alg=\"ed25519\";expires=1794053100;nonce=\"4KEQ-LSY-Jq72KZyaM8KZdJRyCc2osqJKrADiN3MGC5UFaccZaE3ldMv_cFy55cKrl1bkKLi6hx3PrUIte6YCQ\";tag=\"web-bot-auth\""
+  },
+  "expected": {
+    "ok": true,
+    "identity": "https://buyer.example.com"
+  },
+  "$comment": "The buyer signs a GET to https://seller.example.com/proposals/./x/../prop_7, and the request carries that URL as a caller writes it. Its @target-uri is https://seller.example.com/proposals/prop_7: the URL as an HTTP client sends it and a server receives it, the WHATWG URL serialization normalized per RFC 3986 section 6.2.2 (lowercase scheme and host, no default port, no dot segments), with every character a client sends raw left as written. A verifier that parses the URL with a stricter grammar, re-encodes it, or skips the normalization computes another signature base and refuses a valid request."
+}
diff --git a/src/iab_agentic_primitives/web_bot_auth/vectors/refusals.json b/src/iab_agentic_primitives/web_bot_auth/vectors/refusals.json
new file mode 100644
index 0000000..d47e93e
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/vectors/refusals.json
@@ -0,0 +1,173 @@
+{
+  "$comment": "The refusal vocabulary: every rule a verifier refuses with, and its status. Generated from the Refusal enum; a harness grades a refusal by its rule and status.",
+  "refusals": [
+    {
+      "rule": "parse",
+      "status": 400
+    },
+    {
+      "rule": "signature-missing",
+      "status": 403
+    },
+    {
+      "rule": "multiple-signatures",
+      "status": 403
+    },
+    {
+      "rule": "signature-agent-missing",
+      "status": 403
+    },
+    {
+      "rule": "multiple-signature-agents",
+      "status": 403
+    },
+    {
+      "rule": "signature-agent-parameters",
+      "status": 403
+    },
+    {
+      "rule": "signature-agent-not-covered",
+      "status": 403
+    },
+    {
+      "rule": "signature-agent-value",
+      "status": 403
+    },
+    {
+      "rule": "keyid",
+      "status": 403
+    },
+    {
+      "rule": "alg",
+      "status": 403
+    },
+    {
+      "rule": "window",
+      "status": 403
+    },
+    {
+      "rule": "lifetime",
+      "status": 403
+    },
+    {
+      "rule": "created-in-future",
+      "status": 403
+    },
+    {
+      "rule": "expired",
+      "status": 403
+    },
+    {
+      "rule": "nonce-missing",
+      "status": 403
+    },
+    {
+      "rule": "nonce-invalid",
+      "status": 403
+    },
+    {
+      "rule": "components",
+      "status": 403
+    },
+    {
+      "rule": "content-digest",
+      "status": 403
+    },
+    {
+      "rule": "authority",
+      "status": 403
+    },
+    {
+      "rule": "rejected-key",
+      "status": 403
+    },
+    {
+      "rule": "key-not-found",
+      "status": 403
+    },
+    {
+      "rule": "signature-invalid",
+      "status": 403
+    },
+    {
+      "rule": "response-not-bound",
+      "status": 403
+    },
+    {
+      "rule": "origin-mismatch",
+      "status": 403
+    },
+    {
+      "rule": "directory-unavailable",
+      "status": 403
+    },
+    {
+      "rule": "directory-status",
+      "status": 403
+    },
+    {
+      "rule": "directory-encoding",
+      "status": 403
+    },
+    {
+      "rule": "directory-media-type",
+      "status": 403
+    },
+    {
+      "rule": "directory-too-large",
+      "status": 403
+    },
+    {
+      "rule": "directory-content-digest",
+      "status": 403
+    },
+    {
+      "rule": "directory-format",
+      "status": 403
+    },
+    {
+      "rule": "directory-too-many-keys",
+      "status": 403
+    },
+    {
+      "rule": "directory-kid",
+      "status": 403
+    },
+    {
+      "rule": "directory-no-usable-key",
+      "status": 403
+    },
+    {
+      "rule": "directory-signature-parse",
+      "status": 403
+    },
+    {
+      "rule": "directory-one-signature-per-key",
+      "status": 403
+    },
+    {
+      "rule": "directory-tag",
+      "status": 403
+    },
+    {
+      "rule": "directory-components",
+      "status": 403
+    },
+    {
+      "rule": "directory-window",
+      "status": 403
+    },
+    {
+      "rule": "directory-signature",
+      "status": 403
+    },
+    {
+      "rule": "nonce-replayed",
+      "status": 429
+    },
+    {
+      "rule": "nonce-store-unavailable",
+      "status": 503
+    }
+  ]
+}
diff --git a/src/iab_agentic_primitives/web_bot_auth/vectors/scenarios.json b/src/iab_agentic_primitives/web_bot_auth/vectors/scenarios.json
new file mode 100644
index 0000000..ac0bd03
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/vectors/scenarios.json
@@ -0,0 +1,1163 @@
+{
+  "$comment": "Failure scenarios for the Web Bot Auth profile, as data. A harness signs each request, directory, and response scenario at run time, applies after_signing, and grades the verifier on expected: a pass, or a refusal by its status and rule (refusals.json). created and expires are offsets in seconds from the harness clock; a null parameter is omitted; a nonce object asks for that many random bytes in that encoding. verifier is the verifier's own authority, which a request scenario's authority replaces. tier \"wba\": the reference libraries with no profile rules already give the expected outcome. tier \"profile\": the bare libraries give the opposite outcome and only the profile's rules give the expected one; a WBA MUST the library does not enforce stays \"profile\" until it does. Each target_uris case is a GET to url, which each side signs and the other verifies; wire is its @target-uri. See README.md.",
+  "spec": "OpenProposal 3.0 § 2.8",
+  "spec_reference": "https://github.com/IABTechLab/iab-agentic-primitives/blob/main/WEB_BOT_AUTH.md#profile-rules",
+  "signing_profile": "web-bot-auth",
+  "signer": {
+    "identity": "https://buyer.example.com",
+    "kid": "T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84",
+    "signature_agent": "https://buyer.example.com/.well-known/http-message-signatures-directory"
+  },
+  "responder": {
+    "identity": "https://seller.example.com",
+    "kid": "-Rmj_GuEunGbO4x6GQSMCCi0P6oZ32paBkWMnvo3gDU",
+    "signature_agent": "https://seller.example.com/.well-known/http-message-signatures-directory"
+  },
+  "verifier": "seller.example.com",
+  "requests": {
+    "post": {
+      "method": "POST",
+      "url": "https://seller.example.com/proposals/prop_7/commit",
+      "headers": [
+        ["content-type", "application/json"]
+      ],
+      "body": "{\"entry\":{\"role\":\"commitment\",\"version\":3,\"record_digest\":\"sha256:b88664b8699501cb1b984959d4eb663a2036b223400796f269f8ae4c0762ec9f\",\"line_item_ids\":[\"li_1\"],\"at\":\"2026-11-07T12:00:00Z\",\"idempotency_key\":\"ba1fd8f3-d695-4e8d-8629-ee4073b4f184\"},\"writes\":{\"li_1\":{\"commitment\":{\"flight\":{\"start\":\"2026-12-01T00:00:00Z\",\"end\":\"2026-12-31T23:59:59Z\"}}}}}"
+    },
+    "get": {
+      "method": "GET",
+      "url": "https://seller.example.com/proposals/prop_7?view=a%7Eb&x=1",
+      "headers": [],
+      "body": ""
+    }
+  },
+  "components": {
+    "post": [
+      "@method",
+      "@target-uri",
+      "@authority",
+      "content-type",
+      "content-digest",
+      "signature-agent;key={label}"
+    ],
+    "get": [
+      "@method",
+      "@target-uri",
+      "@authority",
+      "signature-agent;key={label}"
+    ]
+  },
+  "parameters": {
+    "created": -5,
+    "expires": 295,
+    "nonce": {
+      "bytes": 64,
+      "encoding": "base64url"
+    },
+    "tag": "web-bot-auth"
+  },
+  "response": {
+    "status": 200,
+    "headers": [
+      ["content-type", "application/json"]
+    ],
+    "body": "{\"entries\":[{\"role\":\"commitment\",\"version\":3,\"record_digest\":\"sha256:b88664b8699501cb1b984959d4eb663a2036b223400796f269f8ae4c0762ec9f\",\"line_item_ids\":[\"li_1\"],\"at\":\"2026-11-07T12:00:00Z\",\"idempotency_key\":\"ba1fd8f3-d695-4e8d-8629-ee4073b4f184\"},{\"role\":\"acceptance\",\"version\":3,\"record_digest\":\"sha256:b88664b8699501cb1b984959d4eb663a2036b223400796f269f8ae4c0762ec9f\",\"line_item_ids\":[\"li_1\"],\"at\":\"2026-11-07T12:00:01Z\"}]}"
+  },
+  "response_components": {
+    "bound": [
+      "@status",
+      "@method;req",
+      "@target-uri;req",
+      "content-type",
+      "content-digest",
+      "signature-agent;key={label}",
+      "signature;req;key={request_label}"
+    ],
+    "unbound": [
+      "@status",
+      "@method;req",
+      "@target-uri;req",
+      "content-type",
+      "content-digest",
+      "signature-agent;key={label}"
+    ]
+  },
+  "response_parameters": {
+    "created": -5,
+    "expires": 295,
+    "tag": "web-bot-auth"
+  },
+  "directory_parameters": {
+    "created": 0,
+    "expires": 86400
+  },
+  "directory_max_age": 300,
+  "request_scenarios": [
+    {
+      "id": "R00",
+      "name": "Baseline",
+      "tier": "wba",
+      "basis": "Profile rules",
+      "expected": {
+        "ok": true,
+        "identity": "https://buyer.example.com"
+      },
+      "base": "post",
+      "label": "sig1"
+    },
+    {
+      "id": "R01",
+      "name": "Body changed after signing",
+      "tier": "profile",
+      "basis": "Content-Digest matches the body: RFC 9530; WBA section 5.2",
+      "expected": {
+        "ok": false,
+        "rule": "content-digest",
+        "status": 403
+      },
+      "base": "post",
+      "label": "sig1",
+      "after_signing": {
+        "append_to_body": "\n"
+      }
+    },
+    {
+      "id": "R02",
+      "name": "Covered header changed after signing",
+      "tier": "wba",
+      "basis": "RFC 9421 section 3.2",
+      "expected": {
+        "ok": false,
+        "rule": "signature-invalid",
+        "status": 403
+      },
+      "base": "post",
+      "label": "sig1",
+      "after_signing": {
+        "headers": {
+          "content-type": "text/plain"
+        }
+      }
+    },
+    {
+      "id": "R03",
+      "name": "Expired",
+      "tier": "wba",
+      "basis": "RFC 9421 section 3.2.1",
+      "expected": {
+        "ok": false,
+        "rule": "expired",
+        "status": 403
+      },
+      "base": "post",
+      "label": "sig1",
+      "parameters": {
+        "created": -400,
+        "expires": -100
+      }
+    },
+    {
+      "id": "R04",
+      "name": "created 120 seconds in the future",
+      "tier": "wba",
+      "basis": "Profile: 60 seconds of clock skew",
+      "expected": {
+        "ok": false,
+        "rule": "created-in-future",
+        "status": 403
+      },
+      "base": "post",
+      "label": "sig1",
+      "parameters": {
+        "created": 120,
+        "expires": 400
+      }
+    },
+    {
+      "id": "R05",
+      "name": "created 30 seconds in the future",
+      "tier": "profile",
+      "basis": "Profile: 60 seconds of clock skew; the library allows none by default",
+      "expected": {
+        "ok": true,
+        "identity": "https://buyer.example.com"
+      },
+      "base": "post",
+      "label": "sig1",
+      "parameters": {
+        "created": 30,
+        "expires": 300
+      }
+    },
+    {
+      "id": "R06",
+      "name": "Lifetime of 3600 seconds",
+      "tier": "profile",
+      "basis": "Profile: expires at most 300 seconds after created",
+      "expected": {
+        "ok": false,
+        "rule": "lifetime",
+        "status": 403
+      },
+      "base": "post",
+      "label": "sig1",
+      "parameters": {
+        "created": -5,
+        "expires": 3595
+      }
+    },
+    {
+      "id": "R07",
+      "name": "Nonce of 32 bytes",
+      "tier": "wba",
+      "basis": "Profile: 64-byte nonce; validateNonce",
+      "expected": {
+        "ok": false,
+        "rule": "nonce-invalid",
+        "status": 403
+      },
+      "base": "post",
+      "label": "sig1",
+      "parameters": {
+        "nonce": {
+          "bytes": 32,
+          "encoding": "base64url"
+        }
+      }
+    },
+    {
+      "id": "R08",
+      "name": "Nonce in canonical padded base64",
+      "tier": "wba",
+      "basis": "Profile: unpadded base64url or canonical padded base64",
+      "expected": {
+        "ok": true,
+        "identity": "https://buyer.example.com"
+      },
+      "base": "post",
+      "label": "sig1",
+      "parameters": {
+        "nonce": {
+          "bytes": 64,
+          "encoding": "base64"
+        }
+      }
+    },
+    {
+      "id": "R09",
+      "name": "Nonce in padded base64url",
+      "tier": "wba",
+      "basis": "Profile: unpadded base64url or canonical padded base64",
+      "expected": {
+        "ok": false,
+        "rule": "nonce-invalid",
+        "status": 403
+      },
+      "base": "post",
+      "label": "sig1",
+      "parameters": {
+        "nonce": {
+          "bytes": 64,
+          "encoding": "base64url-padded"
+        }
+      }
+    },
+    {
+      "id": "R10",
+      "name": "No alg parameter",
+      "tier": "wba",
+      "basis": "Profile: alg required",
+      "expected": {
+        "ok": false,
+        "rule": "alg",
+        "status": 403
+      },
+      "base": "post",
+      "label": "sig1",
+      "parameters": {
+        "alg": null
+      }
+    },
+    {
+      "id": "R11",
+      "name": "alg other than ed25519",
+      "tier": "wba",
+      "basis": "Profile: alg is ed25519 and matches the key; RFC 9421 section 3.2",
+      "expected": {
+        "ok": false,
+        "rule": "alg",
+        "status": 403
+      },
+      "base": "post",
+      "label": "sig1",
+      "parameters": {
+        "alg": "ecdsa-p256-sha256"
+      }
+    },
+    {
+      "id": "R12",
+      "name": "GET covering only @authority and the Signature-Agent member",
+      "tier": "profile",
+      "basis": "Profile: cover @method, @target-uri, and @authority; WBA section 5.2 needs one of @authority or @target-uri",
+      "expected": {
+        "ok": false,
+        "rule": "components",
+        "status": 403
+      },
+      "base": "get",
+      "label": "sig1",
+      "components": ["@authority", "signature-agent;key=sig1"]
+    },
+    {
+      "id": "R13",
+      "name": "Body without content-digest covered",
+      "tier": "profile",
+      "basis": "Profile: a request with a body covers content-type and content-digest; WBA section 5.2",
+      "expected": {
+        "ok": false,
+        "rule": "components",
+        "status": 403
+      },
+      "base": "post",
+      "label": "sig1",
+      "components": [
+        "@method",
+        "@target-uri",
+        "@authority",
+        "content-type",
+        "signature-agent;key=sig1"
+      ]
+    },
+    {
+      "id": "R13b",
+      "name": "Body without content-type covered",
+      "tier": "profile",
+      "basis": "Profile: a request with a body covers content-type and content-digest",
+      "expected": {
+        "ok": false,
+        "rule": "components",
+        "status": 403
+      },
+      "base": "post",
+      "label": "sig1",
+      "components": [
+        "@method",
+        "@target-uri",
+        "@authority",
+        "content-digest",
+        "signature-agent;key=sig1"
+      ]
+    },
+    {
+      "id": "R14",
+      "name": "tag other than web-bot-auth",
+      "tier": "wba",
+      "basis": "WBA section 5.2: tag MUST be web-bot-auth",
+      "expected": {
+        "ok": false,
+        "rule": "signature-missing",
+        "status": 403
+      },
+      "base": "post",
+      "label": "sig1",
+      "parameters": {
+        "tag": "other-profile/v1"
+      }
+    },
+    {
+      "id": "R23",
+      "name": "Components in another order",
+      "tier": "wba",
+      "basis": "RFC 9421: the order is the signer's",
+      "expected": {
+        "ok": true,
+        "identity": "https://buyer.example.com"
+      },
+      "base": "post",
+      "label": "sig1",
+      "components": [
+        "signature-agent;key=sig1",
+        "@authority",
+        "content-digest",
+        "@target-uri",
+        "content-type",
+        "@method"
+      ]
+    },
+    {
+      "id": "R24",
+      "name": "No nonce",
+      "tier": "profile",
+      "basis": "Profile: a nonce on every signed request; WBA leaves it to deployment policy",
+      "expected": {
+        "ok": false,
+        "rule": "nonce-missing",
+        "status": 403
+      },
+      "base": "post",
+      "label": "sig1",
+      "parameters": {
+        "nonce": null
+      }
+    },
+    {
+      "id": "R25",
+      "name": "GET with the profile's components",
+      "tier": "wba",
+      "basis": "Profile rules; a request without a body covers no content-digest",
+      "expected": {
+        "ok": true,
+        "identity": "https://buyer.example.com"
+      },
+      "base": "get",
+      "label": "sig1"
+    },
+    {
+      "id": "R15",
+      "name": "Bare-string Signature-Agent",
+      "tier": "profile",
+      "basis": "Profile: dictionary form only, so the field does not parse; WBA section 5.2.1 lets a verifier accept the bare string",
+      "expected": {
+        "ok": false,
+        "rule": "parse",
+        "status": 400
+      },
+      "base": "post",
+      "label": "sig1",
+      "components": [
+        "@method",
+        "@target-uri",
+        "@authority",
+        "content-type",
+        "content-digest",
+        "signature-agent"
+      ],
+      "signature_agent": "\"https://buyer.example.com/.well-known/http-message-signatures-directory\""
+    },
+    {
+      "id": "R16",
+      "name": "http:// key URL",
+      "tier": "profile",
+      "basis": "WBA section 5.2.1: the scheme MUST be https; the library accepts http (cloudflare/web-bot-auth#162)",
+      "expected": {
+        "ok": false,
+        "rule": "signature-agent-value",
+        "status": 403
+      },
+      "base": "post",
+      "label": "sig1",
+      "signature_agent": "sig1=\"http://buyer.example.com/.well-known/http-message-signatures-directory\"",
+      "directories": {
+        "http://buyer.example.com": [
+          "T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84"
+        ]
+      }
+    },
+    {
+      "id": "R16b",
+      "name": "http:// origin",
+      "tier": "profile",
+      "basis": "WBA section 5.2.1: the scheme MUST be https",
+      "expected": {
+        "ok": false,
+        "rule": "signature-agent-value",
+        "status": 403
+      },
+      "base": "post",
+      "label": "sig1",
+      "signature_agent": "sig1=\"http://buyer.example.com\"",
+      "directories": {
+        "http://buyer.example.com": [
+          "T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84"
+        ]
+      }
+    },
+    {
+      "id": "R17",
+      "name": "Path other than the well-known path",
+      "tier": "profile",
+      "basis": "Profile: the value is exactly https://<host>/.well-known/http-message-signatures-directory or https://<host>, compared without normalizing; the library does not check it",
+      "expected": {
+        "ok": false,
+        "rule": "signature-agent-value",
+        "status": 403
+      },
+      "base": "post",
+      "label": "sig1",
+      "signature_agent": "sig1=\"https://buyer.example.com/jwks.json\""
+    },
+    {
+      "id": "R17a",
+      "name": "Well-known path with a trailing /",
+      "tier": "profile",
+      "basis": "Profile: the value is exactly https://<host>/.well-known/http-message-signatures-directory or https://<host>, compared without normalizing; no trailing /",
+      "expected": {
+        "ok": false,
+        "rule": "signature-agent-value",
+        "status": 403
+      },
+      "base": "post",
+      "label": "sig1",
+      "signature_agent": "sig1=\"https://buyer.example.com/.well-known/http-message-signatures-directory/\""
+    },
+    {
+      "id": "R17b",
+      "name": "Well-known path in another case",
+      "tier": "profile",
+      "basis": "Profile: the value is exactly https://<host>/.well-known/http-message-signatures-directory or https://<host>, compared without normalizing; the path is compared as a string",
+      "expected": {
+        "ok": false,
+        "rule": "signature-agent-value",
+        "status": 403
+      },
+      "base": "post",
+      "label": "sig1",
+      "signature_agent": "sig1=\"https://buyer.example.com/.well-known/HTTP-Message-Signatures-Directory\""
+    },
+    {
+      "id": "R17c",
+      "name": "Origin with a trailing /",
+      "tier": "profile",
+      "basis": "Profile: the value is exactly https://<host>/.well-known/http-message-signatures-directory or https://<host>, compared without normalizing; no trailing /",
+      "expected": {
+        "ok": false,
+        "rule": "signature-agent-value",
+        "status": 403
+      },
+      "base": "post",
+      "label": "sig1",
+      "signature_agent": "sig1=\"https://buyer.example.com/\""
+    },
+    {
+      "id": "R17d",
+      "name": "Uppercase host",
+      "tier": "profile",
+      "basis": "Profile: the value is exactly https://<host>/.well-known/http-message-signatures-directory or https://<host>, compared without normalizing; a lowercase host",
+      "expected": {
+        "ok": false,
+        "rule": "signature-agent-value",
+        "status": 403
+      },
+      "base": "post",
+      "label": "sig1",
+      "signature_agent": "sig1=\"https://BUYER.example.com/.well-known/http-message-signatures-directory\""
+    },
+    {
+      "id": "R17e",
+      "name": "Explicit :443",
+      "tier": "profile",
+      "basis": "Profile: the value is exactly https://<host>/.well-known/http-message-signatures-directory or https://<host>, compared without normalizing; no port",
+      "expected": {
+        "ok": false,
+        "rule": "signature-agent-value",
+        "status": 403
+      },
+      "base": "post",
+      "label": "sig1",
+      "signature_agent": "sig1=\"https://buyer.example.com:443/.well-known/http-message-signatures-directory\""
+    },
+    {
+      "id": "R17f",
+      "name": "Other port",
+      "tier": "profile",
+      "basis": "Profile: the value is exactly https://<host>/.well-known/http-message-signatures-directory or https://<host>, compared without normalizing; no port",
+      "expected": {
+        "ok": false,
+        "rule": "signature-agent-value",
+        "status": 403
+      },
+      "base": "post",
+      "label": "sig1",
+      "signature_agent": "sig1=\"https://buyer.example.com:8443/.well-known/http-message-signatures-directory\"",
+      "directories": {
+        "https://buyer.example.com:8443": [
+          "T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84"
+        ]
+      }
+    },
+    {
+      "id": "R17g",
+      "name": "Query",
+      "tier": "profile",
+      "basis": "Profile: the value is exactly https://<host>/.well-known/http-message-signatures-directory or https://<host>, compared without normalizing; no query",
+      "expected": {
+        "ok": false,
+        "rule": "signature-agent-value",
+        "status": 403
+      },
+      "base": "post",
+      "label": "sig1",
+      "signature_agent": "sig1=\"https://buyer.example.com/.well-known/http-message-signatures-directory?v=1\""
+    },
+    {
+      "id": "R17h",
+      "name": "Fragment",
+      "tier": "profile",
+      "basis": "Profile: the value is exactly https://<host>/.well-known/http-message-signatures-directory or https://<host>, compared without normalizing; no fragment",
+      "expected": {
+        "ok": false,
+        "rule": "signature-agent-value",
+        "status": 403
+      },
+      "base": "post",
+      "label": "sig1",
+      "signature_agent": "sig1=\"https://buyer.example.com/.well-known/http-message-signatures-directory#k\""
+    },
+    {
+      "id": "R17i",
+      "name": "Userinfo",
+      "tier": "profile",
+      "basis": "Profile: the value is exactly https://<host>/.well-known/http-message-signatures-directory or https://<host>, compared without normalizing; no userinfo",
+      "expected": {
+        "ok": false,
+        "rule": "signature-agent-value",
+        "status": 403
+      },
+      "base": "post",
+      "label": "sig1",
+      "signature_agent": "sig1=\"https://agent@buyer.example.com/.well-known/http-message-signatures-directory\""
+    },
+    {
+      "id": "R17j",
+      "name": "Origin with a query",
+      "tier": "profile",
+      "basis": "Profile: the value is exactly https://<host>/.well-known/http-message-signatures-directory or https://<host>, compared without normalizing; no query",
+      "expected": {
+        "ok": false,
+        "rule": "signature-agent-value",
+        "status": 403
+      },
+      "base": "post",
+      "label": "sig1",
+      "signature_agent": "sig1=\"https://buyer.example.com?v=1\""
+    },
+    {
+      "id": "R18",
+      "name": "Member with type=jwks_uri",
+      "tier": "profile",
+      "basis": "WBA -01 section 5.2.1: a verifier MUST ignore a member that carries parameters",
+      "expected": {
+        "ok": false,
+        "rule": "signature-agent-parameters",
+        "status": 403
+      },
+      "base": "post",
+      "label": "sig1",
+      "signature_agent": "sig1=\"https://buyer.example.com/jwks.json\";type=jwks_uri"
+    },
+    {
+      "id": "R18c",
+      "name": "Origin member with type=directory as a Token",
+      "tier": "profile",
+      "basis": "WBA -01 section 5.2.1: members MUST NOT carry parameters, and a verifier MUST ignore one that does",
+      "expected": {
+        "ok": false,
+        "rule": "signature-agent-parameters",
+        "status": 403
+      },
+      "base": "post",
+      "label": "sig1",
+      "signature_agent": "sig1=\"https://buyer.example.com\";type=directory"
+    },
+    {
+      "id": "R18d",
+      "name": "Key URL member with type=\"directory\" as a String",
+      "tier": "profile",
+      "basis": "WBA -01 section 5.2.1: members MUST NOT carry parameters, and a verifier MUST ignore one that does",
+      "expected": {
+        "ok": false,
+        "rule": "signature-agent-parameters",
+        "status": 403
+      },
+      "base": "post",
+      "label": "sig1",
+      "signature_agent": "sig1=\"https://buyer.example.com/.well-known/http-message-signatures-directory\";type=\"directory\""
+    },
+    {
+      "id": "R18e",
+      "name": "Bare origin, the draft -00 form",
+      "tier": "wba",
+      "basis": "WBA -00 section 5.5: a directory member is an origin; the verifier fetches the same well-known URL",
+      "expected": {
+        "ok": true,
+        "identity": "https://buyer.example.com"
+      },
+      "base": "post",
+      "label": "sig1",
+      "signature_agent": "sig1=\"https://buyer.example.com\""
+    },
+    {
+      "id": "R19",
+      "name": "Signature-Agent member keyed differently from the label",
+      "tier": "profile",
+      "basis": "WBA section 5.2.1: the member keyed to the label; the library does not check it",
+      "expected": {
+        "ok": false,
+        "rule": "signature-agent-missing",
+        "status": 403
+      },
+      "base": "post",
+      "label": "sig1",
+      "components": [
+        "@method",
+        "@target-uri",
+        "@authority",
+        "content-type",
+        "content-digest",
+        "signature-agent;key=agent1"
+      ],
+      "signature_agent": "agent1=\"https://buyer.example.com/.well-known/http-message-signatures-directory\""
+    },
+    {
+      "id": "R21",
+      "name": "Two Signature-Agent members, one signature",
+      "tier": "profile",
+      "basis": "Profile: exactly one Signature-Agent member",
+      "expected": {
+        "ok": false,
+        "rule": "multiple-signature-agents",
+        "status": 403
+      },
+      "base": "post",
+      "label": "sig1",
+      "signature_agent": "sig1=\"https://buyer.example.com/.well-known/http-message-signatures-directory\", sig2=\"https://other.example.com/.well-known/http-message-signatures-directory\""
+    },
+    {
+      "id": "R22",
+      "name": "Label other than sig1",
+      "tier": "wba",
+      "basis": "RFC 9421: the signer chooses the label",
+      "expected": {
+        "ok": true,
+        "identity": "https://buyer.example.com"
+      },
+      "base": "post",
+      "label": "wba"
+    },
+    {
+      "id": "R20",
+      "name": "Second signature with tag cdn-edge",
+      "tier": "profile",
+      "basis": "Profile: Signature-Input members with other tags are not read; the library requires a label when a request carries two signatures",
+      "expected": {
+        "ok": true,
+        "identity": "https://buyer.example.com"
+      },
+      "base": "post",
+      "label": "sig1",
+      "extra_signature": {
+        "label": "cdn",
+        "kid": "VR0Gby4SzMlU2nttpc8Ondksz1_VWMBzuycc-DzuQHc",
+        "components": ["@method", "@authority"],
+        "parameters": {
+          "created": -5,
+          "expires": 295,
+          "nonce": null,
+          "tag": "cdn-edge"
+        }
+      }
+    },
+    {
+      "id": "R20b",
+      "name": "Second member with tag cdn-edge whose Signature value is a token",
+      "tier": "wba",
+      "basis": "RFC 9421 section 4.2: every Signature member value is a Byte Sequence, so the field is malformed whatever the member's tag",
+      "expected": {
+        "ok": false,
+        "rule": "parse",
+        "status": 400
+      },
+      "base": "post",
+      "label": "sig1",
+      "after_signing": {
+        "append_members": {
+          "signature-input": "cdn=(\"@method\" \"@authority\");tag=\"cdn-edge\"",
+          "signature": "cdn=edge-token"
+        }
+      }
+    },
+    {
+      "id": "R26",
+      "name": "Signed for seller.example.com, verified by seller-b.example.com",
+      "tier": "profile",
+      "basis": "OpenProposal § 2.8.4 step 5: the signed @authority is the verifier's own configured authority, never the Host it was sent",
+      "expected": {
+        "ok": false,
+        "rule": "authority",
+        "status": 403
+      },
+      "base": "post",
+      "label": "sig1",
+      "authority": "seller-b.example.com"
+    }
+  ],
+  "directory_scenarios": [
+    {
+      "id": "D00",
+      "name": "Baseline",
+      "tier": "wba",
+      "basis": "WBA Appendix B.1",
+      "expected": {
+        "ok": true
+      }
+    },
+    {
+      "id": "D01",
+      "name": "Signed for another authority",
+      "tier": "wba",
+      "basis": "WBA Appendix B.1: covers \"@authority\";req",
+      "expected": {
+        "ok": false,
+        "rule": "directory-signature",
+        "status": 403
+      },
+      "authority": "other.example.com"
+    },
+    {
+      "id": "D02",
+      "name": "Body changed after signing",
+      "tier": "profile",
+      "basis": "WBA Appendix B.1: the verifier MUST validate Content-Digest; the library does not compare it with the body",
+      "expected": {
+        "ok": false,
+        "rule": "directory-content-digest",
+        "status": 403
+      },
+      "after_signing": {
+        "append_to_body": "\n"
+      }
+    },
+    {
+      "id": "D03",
+      "name": "Unsigned",
+      "tier": "wba",
+      "basis": "Profile: every Ed25519 key signs (Appendix B.1 recommends it)",
+      "expected": {
+        "ok": false,
+        "rule": "directory-one-signature-per-key",
+        "status": 403
+      },
+      "keys": [],
+      "unsigned_keys": [
+        {
+          "kty": "OKP",
+          "crv": "Ed25519",
+          "kid": "T5rd7MzhvzHtrBDE04NVTnFpBFb63tjmy9o0JrtFH84",
+          "x": "eaZpKteR6m0v7GQPeK0Hv4B0DdvqI99SsTPztodAE5w",
+          "use": "sig"
+        }
+      ]
+    },
+    {
+      "id": "D04",
+      "name": "Signature created in the future",
+      "tier": "wba",
+      "basis": "WBA Appendix B.1: reject a future created; the profile allows the same 60 s skew as for requests",
+      "expected": {
+        "ok": false,
+        "rule": "directory-window",
+        "status": 403
+      },
+      "parameters": {
+        "created": 3600,
+        "expires": 90000
+      }
+    },
+    {
+      "id": "D05",
+      "name": "Covers \"@authority\";req only",
+      "tier": "profile",
+      "basis": "WBA Appendix B.1: covers content-digest",
+      "expected": {
+        "ok": false,
+        "rule": "directory-components",
+        "status": 403
+      },
+      "components": [
+        "@authority;req"
+      ]
+    },
+    {
+      "id": "D06",
+      "name": "Expired signature",
+      "tier": "wba",
+      "basis": "RFC 9421 section 3.2.1",
+      "expected": {
+        "ok": false,
+        "rule": "directory-window",
+        "status": 403
+      },
+      "parameters": {
+        "created": -7200,
+        "expires": -3600
+      }
+    },
+    {
+      "id": "D07",
+      "name": "Extra P-256 key that does not sign",
+      "tier": "wba",
+      "basis": "Profile: ignore keys the profile does not use (RFC 7517 section 5)",
+      "expected": {
+        "ok": true
+      },
+      "unsigned_keys": [
+        {
+          "kty": "EC",
+          "crv": "P-256",
+          "x": "ArXncr6ZErPFgXrSNK1KOKudgiJHgP-4Is8qwtccObY",
+          "y": "2cbTVFLdzD1p2A2hoYxW4eCFEoRtP-ycYTvjimo3sGM",
+          "kid": "55mk-PC9BklPC5aPgL1ONxpbh-xnPs1J79S0ZGWUbAM",
+          "use": "sig"
+        }
+      ]
+    },
+    {
+      "id": "D08",
+      "name": "Media type application/json",
+      "tier": "profile",
+      "basis": "WBA section 5.5.1: the well-known directory MUST be served with application/http-message-signatures-directory+json",
+      "expected": {
+        "ok": false,
+        "rule": "directory-media-type",
+        "status": 403
+      },
+      "content_type": "application/json"
+    },
+    {
+      "id": "D09",
+      "name": "Signature expired one second ago",
+      "tier": "wba",
+      "basis": "Profile: the clock skew applies to created only; a directory verifies until its expires",
+      "expected": {
+        "ok": false,
+        "rule": "directory-window",
+        "status": 403
+      },
+      "parameters": {
+        "created": -600,
+        "expires": -1
+      }
+    },
+    {
+      "id": "D10",
+      "name": "Signature that expires now",
+      "tier": "wba",
+      "basis": "Profile: a directory verifies until its expires, that second included",
+      "expected": {
+        "ok": true
+      },
+      "parameters": {
+        "created": -600,
+        "expires": 0
+      }
+    }
+  ],
+  "response_scenarios": [
+    {
+      "id": "P00",
+      "name": "Baseline, bound to the signed request",
+      "tier": "wba",
+      "basis": "OpenProposal 3.0 § 2.8: response components; RFC 9421 section 2.4",
+      "expected": {
+        "ok": true,
+        "identity": "https://seller.example.com"
+      },
+      "label": "sig1",
+      "request": "bound"
+    },
+    {
+      "id": "P01",
+      "name": "Body changed after signing",
+      "tier": "profile",
+      "basis": "Content-Digest matches the body: RFC 9530",
+      "expected": {
+        "ok": false,
+        "rule": "content-digest",
+        "status": 403
+      },
+      "label": "sig1",
+      "request": "bound",
+      "after_signing": {
+        "append_to_body": "\n"
+      }
+    },
+    {
+      "id": "P02",
+      "name": "Status changed after signing",
+      "tier": "wba",
+      "basis": "RFC 9421 section 2.2.9: @status is covered",
+      "expected": {
+        "ok": false,
+        "rule": "signature-invalid",
+        "status": 403
+      },
+      "label": "sig1",
+      "request": "bound",
+      "after_signing": {
+        "status": 201
+      }
+    },
+    {
+      "id": "P03",
+      "name": "Signed request, response not bound to it",
+      "tier": "profile",
+      "basis": "Profile: a response to a signed request covers \"signature\";req;key=<request label>",
+      "expected": {
+        "ok": false,
+        "rule": "response-not-bound",
+        "status": 403
+      },
+      "label": "sig1",
+      "components": [
+        "@status",
+        "@method;req",
+        "@target-uri;req",
+        "content-type",
+        "content-digest",
+        "signature-agent;key={label}"
+      ],
+      "request": "bound"
+    },
+    {
+      "id": "P04",
+      "name": "Bound to another request",
+      "tier": "wba",
+      "basis": "RFC 9421 section 2.4: the request's signature is covered",
+      "expected": {
+        "ok": false,
+        "rule": "signature-invalid",
+        "status": 403
+      },
+      "label": "sig1",
+      "request": "bound",
+      "after_signing": {
+        "request_headers": {
+          "Signature": "sig1=:AAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAAA==:"
+        }
+      }
+    },
+    {
+      "id": "P05",
+      "name": "@status not covered",
+      "tier": "profile",
+      "basis": "Profile: response components",
+      "expected": {
+        "ok": false,
+        "rule": "components",
+        "status": 403
+      },
+      "label": "sig1",
+      "components": [
+        "@method;req",
+        "@target-uri;req",
+        "content-type",
+        "content-digest",
+        "signature-agent;key={label}",
+        "signature;req;key={request_label}"
+      ],
+      "request": "bound"
+    },
+    {
+      "id": "P06",
+      "name": "Lifetime of 3600 seconds",
+      "tier": "profile",
+      "basis": "Profile: expires at most 300 seconds after created",
+      "expected": {
+        "ok": false,
+        "rule": "lifetime",
+        "status": 403
+      },
+      "label": "sig1",
+      "parameters": {
+        "created": -5,
+        "expires": 3595
+      },
+      "request": "bound"
+    },
+    {
+      "id": "P07",
+      "name": "Unsigned request, response without a binding",
+      "tier": "wba",
+      "basis": "Profile: the binding applies when the request carried a signature",
+      "expected": {
+        "ok": true,
+        "identity": "https://seller.example.com"
+      },
+      "label": "sig1",
+      "request": "unbound"
+    },
+    {
+      "id": "P08",
+      "name": "Response signed with tag other than web-bot-auth",
+      "tier": "profile",
+      "basis": "Profile: tag web-bot-auth",
+      "expected": {
+        "ok": false,
+        "rule": "signature-missing",
+        "status": 403
+      },
+      "label": "sig1",
+      "parameters": {
+        "tag": "other-profile/v1"
+      },
+      "request": "bound"
+    }
+  ],
+  "target_uris": [
+    {
+      "id": "U01",
+      "name": "Array brackets in the query",
+      "url": "https://seller.example.com/proposals?ids[]=1",
+      "wire": "https://seller.example.com/proposals?ids[]=1",
+      "basis": "Profile: @target-uri is the URL as it travels on the wire (RFC 3986 § 6.2.2)"
+    },
+    {
+      "id": "U02",
+      "name": "A pipe in the query",
+      "url": "https://seller.example.com/proposals?f=a|b",
+      "wire": "https://seller.example.com/proposals?f=a|b",
+      "basis": "Profile: @target-uri is the URL as it travels on the wire (RFC 3986 § 6.2.2)"
+    },
+    {
+      "id": "U03",
+      "name": "Braces in the query",
+      "url": "https://seller.example.com/proposals?q={json}",
+      "wire": "https://seller.example.com/proposals?q={json}",
+      "basis": "Profile: @target-uri is the URL as it travels on the wire (RFC 3986 § 6.2.2)"
+    },
+    {
+      "id": "U04",
+      "name": "A caret in the query",
+      "url": "https://seller.example.com/proposals?q=a^b",
+      "wire": "https://seller.example.com/proposals?q=a^b",
+      "basis": "Profile: @target-uri is the URL as it travels on the wire (RFC 3986 § 6.2.2)"
+    },
+    {
+      "id": "U05",
+      "name": "An escaped space in the path",
+      "url": "https://seller.example.com/proposals/a%20b",
+      "wire": "https://seller.example.com/proposals/a%20b",
+      "basis": "Profile: @target-uri is the URL as it travels on the wire (RFC 3986 § 6.2.2)"
+    },
+    {
+      "id": "U06",
+      "name": "The default port",
+      "url": "https://seller.example.com:443/proposals/prop_7",
+      "wire": "https://seller.example.com/proposals/prop_7",
+      "basis": "Profile: @target-uri is the URL as it travels on the wire (RFC 3986 § 6.2.2)"
+    },
+    {
+      "id": "U07",
+      "name": "A mixed-case scheme and host",
+      "url": "HTTPS://Seller.Example.COM/proposals/prop_7",
+      "wire": "https://seller.example.com/proposals/prop_7",
+      "basis": "Profile: @target-uri is the URL as it travels on the wire (RFC 3986 § 6.2.2)"
+    },
+    {
+      "id": "U08",
+      "name": "Dot segments in the path",
+      "url": "https://seller.example.com/proposals/./x/../prop_7",
+      "wire": "https://seller.example.com/proposals/prop_7",
+      "basis": "Profile: @target-uri is the URL as it travels on the wire (RFC 3986 § 6.2.2)"
+    }
+  ]
+}
diff --git a/src/iab_agentic_primitives/web_bot_auth/verifier.py b/src/iab_agentic_primitives/web_bot_auth/verifier.py
new file mode 100644
index 0000000..668334b
--- /dev/null
+++ b/src/iab_agentic_primitives/web_bot_auth/verifier.py
@@ -0,0 +1,532 @@
+"""Verifying requests and responses under the profile.
+
+:class:`RequestVerifier` confirms a request's ``web-bot-auth`` signature and
+returns a :class:`VerifiedRequest`; :class:`ResponseVerifier` confirms a
+response's and returns a :class:`VerifiedResponse`. Neither decides anything
+else: the caller maps ``origin`` to its own stored principal. Only this module
+constructs the two credentials, and both are frozen. So are the verifiers.
+
+Both run the steps of WEB_BOT_AUTH.md, "Verification procedure", in its
+order. Each step below names the step it implements:
+
+- :func:`_select`: "Parse the fields" and "Select the signature".
+- :func:`_check_authority`: "Check the authority", for a request only.
+- :func:`_check_parameters`: "Check the parameters".
+- :func:`_check_components`: "Check the components".
+- :func:`_check_signer`: "Check the signer", for a response only.
+- :meth:`_Verifier._authenticate`: "Resolve the key" and "Verify the
+  signature".
+- :meth:`RequestVerifier._record`: "Check the nonce".
+"""
+
+from __future__ import annotations
+
+import logging
+from collections.abc import Awaitable, Callable, Collection
+from dataclasses import InitVar, dataclass, field
+from typing import Final, Literal
+
+from . import _sig
+from ._wire import (
+    ComponentId,
+    ContentDigestError,
+    SignatureFields,
+    SignatureMember,
+    check_content_digest,
+    is_signed,
+    parse_signature_fields,
+)
+from .directory import VerifiedDirectory
+from .errors import ConfigurationError, Refusal, WebBotAuthError, refuse
+from .message import HeaderLines, HTTPRequest, HTTPResponse
+from .ports import KeyResolver
+from .replay import NonceStore, NonceStoreUnavailable
+from .rules import (
+    ALGORITHM,
+    CONTENT_DIGEST,
+    REQUEST,
+    RESPONSE,
+    SIGNATURE_TAG,
+    TEST_KEY_IDS,
+    Rules,
+    signature_agent_component,
+    web_bot_auth_label,
+)
+from .values import (
+    Clock,
+    KeyId,
+    Origin,
+    Seconds,
+    ServerIdentity,
+    UnixSeconds,
+    authority_of,
+    key_id_set,
+    system_clock,
+)
+
+logger = logging.getLogger(__name__)
+
+#: The mode in which a response must carry the signature of the host the request went to.
+SAME_ORIGIN: Final = "same-origin"
+
+#: Whose signature a response must carry: an :class:`Origin`; :data:`SAME_ORIGIN`,
+#: the identity of the host the request went to, :meth:`Origin.of_url` of its URL;
+#: or ``None``, any identity.
+ExpectedOrigin = Origin | Literal["same-origin"] | None
+
+
+class _Token:
+    """Proof that this module made a credential: it alone holds the instance."""
+
+    __slots__ = ()
+
+
+_OWNER = _Token()
+
+
+@dataclass(frozen=True, slots=True)
+class _Credential:
+    """What both credentials hold. Only this module can make one.
+
+    Construction needs this module's private token, so ``dataclasses.replace``,
+    ``type(v)(...)``, and a direct call raise ``TypeError``. Copying and
+    pickling raise too: a credential is the result of a verification, and the
+    way to get another one is to verify again.
+    """
+
+    origin: Origin
+    keyid: KeyId
+    label: str
+    created: UnixSeconds
+    expires: UnixSeconds
+    components: tuple[ComponentId, ...]
+    body_covered: bool
+    directory: VerifiedDirectory | None = field(compare=False, repr=False)
+    _token: InitVar[_Token | None] = field(default=None, kw_only=True)
+
+    def __post_init__(self, _token: _Token | None) -> None:
+        if _token is not _OWNER:
+            raise TypeError(f"a {type(self).__name__} is made only by verifying a message")
+
+    def __reduce_ex__(self, protocol: object) -> tuple[object, ...]:
+        raise TypeError(f"a {type(self).__name__} can't be copied or pickled; verify again")
+
+
+@dataclass(frozen=True, slots=True)
+class VerifiedRequest(_Credential):
+    """A verified, replay-checked ``web-bot-auth`` request signature.
+
+    ``origin`` is the identity the request is attributed to, ``https://<host>``,
+    whichever form ``Signature-Agent`` used. ``created``, ``expires``, and
+    ``nonce`` are the parameters the signature authenticates, and
+    ``components`` the covered component identifiers.
+    ``body_covered`` is ``True`` when the signature covers ``content-digest``
+    and the digest matched the body. ``directory`` is the verified key
+    directory the key came from, with the response bytes as evidence, when the
+    resolver provides it (:class:`DirectoryResolver` does).
+    """
+
+    nonce: str
+
+
+@dataclass(frozen=True, slots=True)
+class VerifiedResponse(_Credential):
+    """A verified ``web-bot-auth`` response signature.
+
+    The fields read as on :class:`VerifiedRequest`. ``bound`` is ``True`` when
+    the signature covers the signature of the request it answers; it is
+    ``False`` only for a response to an unsigned request.
+    """
+
+    bound: bool
+
+
+# ── the steps ─────────────────────────────────────────────────────────────
+
+
+@dataclass(frozen=True, slots=True)
+class _Selected:
+    """The one ``web-bot-auth`` member and the origin its ``Signature-Agent`` names."""
+
+    member: SignatureMember
+    origin: Origin
+
+
+def select_signature_agent(fields: SignatureFields, label: str) -> Origin:
+    """The origin the ``Signature-Agent`` member ``label`` names.
+
+    The signature ``label`` must cover that member. A member that carries
+    parameters is ignored (draft -01 section 5.2.1).
+    """
+    agents = {k: a for k, a in fields.agents.items() if not a.has_parameters}
+    if label in fields.repeated_agents:
+        raise refuse(
+            Refusal.MULTIPLE_SIGNATURE_AGENTS, f"Signature-Agent member {label} is repeated"
+        )
+    if len(agents) > 1:
+        raise refuse(
+            Refusal.MULTIPLE_SIGNATURE_AGENTS,
+            f"{len(agents)} Signature-Agent members; the profile takes one",
+        )
+    if label not in agents:
+        if label in fields.agents:
+            raise refuse(
+                Refusal.SIGNATURE_AGENT_PARAMETERS,
+                f"Signature-Agent member {label} carries parameters, so it is ignored",
+            )
+        raise refuse(
+            Refusal.SIGNATURE_AGENT_MISSING, f"Signature-Agent has no member keyed to {label}"
+        )
+    covered = signature_agent_component(label)
+    if covered not in fields[label].components:
+        raise refuse(Refusal.SIGNATURE_AGENT_NOT_COVERED, f"the signature does not cover {covered}")
+    return Origin.from_signature_agent(agents[label].value)
+
+
+def _select(lines: HeaderLines) -> _Selected:
+    """Parse the fields and select the signature: the member and the origin it names.
+
+    A message that isn't signed (:func:`is_signed`) is refused
+    ``signature-missing``: the verifier was asked for a signature it doesn't carry.
+    """
+    fields = parse_signature_fields(lines)
+    if fields is None:
+        raise refuse(Refusal.SIGNATURE_MISSING, "the message carries no Signature-Input")
+    member = fields.one_tagged(SIGNATURE_TAG)
+    return _Selected(member, select_signature_agent(fields, member.label))
+
+
+def _check_parameters[M: (HTTPRequest, HTTPResponse), N: (str, str | None)](
+    member: SignatureMember, rules: Rules[M, N], now: UnixSeconds
+) -> tuple[KeyId, N]:
+    """Check the parameters: ``keyid``, ``alg``, the window, and the nonce rule.
+
+    Returns the key id, and the nonce as the rule gives it.
+    """
+    if not member.keyid:
+        raise refuse(Refusal.KEYID, "keyid is missing")
+    if member.alg != ALGORITHM:
+        raise refuse(Refusal.ALG, f"alg must be {ALGORITHM}, not {member.alg!r}")
+    rules.window.check(member.created, member.expires, now)
+    return member.keyid, rules.nonce_of(member.nonce)
+
+
+def _check_components[M: (HTTPRequest, HTTPResponse), N: (str, str | None)](
+    member: SignatureMember, required: tuple[ComponentId, ...], rules: Rules[M, N]
+) -> None:
+    """Check the components: the signature covers every one the rules require."""
+    for component in required:
+        if component not in member.components:
+            raise refuse(rules.missing(component), f"{component} is not covered")
+
+
+def _check_authority(request: HTTPRequest, identity: ServerIdentity) -> None:
+    """Check the authority: the request names this server's own authority."""
+    try:
+        authority = authority_of(request.url)
+    except ValueError as e:
+        raise refuse(Refusal.AUTHORITY, f"{request.url!r} is not an absolute URL") from e
+    if authority != identity.request_authority:
+        raise refuse(Refusal.AUTHORITY, f"the request is for {authority}, not this verifier")
+
+
+def _expected_signer(response: HTTPResponse, expected: ExpectedOrigin) -> Origin | None:
+    """The origin ``response`` must be signed by, under ``expected``; ``None`` for any.
+
+    Under :data:`SAME_ORIGIN` it is the identity of the host the request went
+    to (a responder names its own origin), which :meth:`Origin.of_url` maps;
+    a host that can't be an identity can't have signed, so it is refused.
+    """
+    if expected is None or isinstance(expected, Origin):
+        return expected
+    url = response.request.url
+    try:
+        return Origin.of_url(url)
+    except ConfigurationError as e:
+        raise refuse(Refusal.ORIGIN_MISMATCH, f"{url!r} names no host an identity can be") from e
+
+
+def _check_signer(origin: Origin, expected: Origin | None) -> None:
+    """Check the signer: the response comes from ``expected``, when it is given."""
+    if expected is not None and origin != expected:
+        raise refuse(Refusal.ORIGIN_MISMATCH, f"the response is signed by {origin}, not {expected}")
+
+
+def _covered_body(member: SignatureMember, lines: HeaderLines, body: bytes) -> bytes | None:
+    """The body when the signature covers ``Content-Digest``, checked against the digest.
+
+    The profile requires the coverage for a message with a body, so ``None``
+    means an empty body that the signature doesn't cover.
+    """
+    if CONTENT_DIGEST not in member.components:
+        return None
+    try:
+        check_content_digest(lines, body)
+    except ContentDigestError as e:
+        raise refuse(Refusal.CONTENT_DIGEST, str(e)) from e
+    return body
+
+
+@dataclass(frozen=True, slots=True)
+class _Authenticated:
+    origin: Origin
+    result: _sig.VerifyResult
+    directory: VerifiedDirectory | None
+
+    def request(self, nonce: str) -> VerifiedRequest:
+        """The request credential, from the parameters the library authenticated."""
+        r = self.result
+        return VerifiedRequest(
+            self.origin,
+            r.keyid,
+            r.label,
+            r.created,
+            r.expires,
+            r.components,
+            r.body is not None,
+            self.directory,
+            nonce=nonce,
+            _token=_OWNER,
+        )
+
+    def response(self, *, bound: bool) -> VerifiedResponse:
+        """The response credential, from the parameters the library authenticated."""
+        r = self.result
+        return VerifiedResponse(
+            self.origin,
+            r.keyid,
+            r.label,
+            r.created,
+            r.expires,
+            r.components,
+            r.body is not None,
+            self.directory,
+            bound=bound,
+            _token=_OWNER,
+        )
+
+
+def _log_refusal(role: str, selected: _Selected | None, error: WebBotAuthError) -> None:
+    """Logs a refusal with the origin and keyid once they are known; never a nonce or a body."""
+    logger.info(
+        "refused a %s: %s %s (origin %s, keyid %s): %s",
+        role,
+        error.status,
+        error.reason,
+        "unknown" if selected is None else selected.origin,
+        (selected and selected.member.keyid) or "unknown",
+        error,
+    )
+
+
+async def _logged[T](
+    role: str, message: HTTPRequest | HTTPResponse, verify: Callable[[_Selected], Awaitable[T]]
+) -> T:
+    """Selects the signature on ``message`` and runs ``verify`` on it, logging a refusal."""
+    selected: _Selected | None = None
+    try:
+        selected = _select(message.headers)
+        return await verify(selected)
+    except WebBotAuthError as e:
+        _log_refusal(role, selected, e)
+        raise
+
+
+# ── the verifiers ─────────────────────────────────────────────────────────
+
+
+@dataclass(frozen=True, slots=True, init=False)
+class KeyPolicy:
+    """Which key ids a verifier refuses, checked once when it is made.
+
+    A verifier always refuses the published test keys,
+    :data:`~.rules.TEST_KEY_IDS` (Web Bot Auth section 6.8), and the key ids
+    ``reject_keyids`` lists on top of them. ``accept_test_keys`` lets the test
+    keys verify, for a conformance run and nothing else;
+    :data:`CONFORMANCE_KEYS` is that policy. ``reject_keyids`` is a
+    collection of strings, never a bare string, and ``accept_test_keys`` a
+    ``bool``; anything else raises :class:`ConfigurationError`.
+    """
+
+    reject_keyids: frozenset[KeyId]
+    accept_test_keys: bool
+
+    def __init__(
+        self, *, reject_keyids: Collection[str] = (), accept_test_keys: bool = False
+    ) -> None:
+        if not isinstance(accept_test_keys, bool):
+            raise ConfigurationError(f"accept_test_keys is True or False, not {accept_test_keys!r}")
+        object.__setattr__(self, "reject_keyids", key_id_set(reject_keyids))
+        object.__setattr__(self, "accept_test_keys", accept_test_keys)
+
+    @property
+    def refused(self) -> frozenset[KeyId]:
+        """Every key id the verifier refuses: the listed ones, and the test keys unless accepted."""
+        return self.reject_keyids | (frozenset() if self.accept_test_keys else TEST_KEY_IDS)
+
+
+#: The default policy: refuse the published test keys.
+DEFAULT_KEYS: Final = KeyPolicy()
+#: The policy of a conformance run, whose vectors are signed with the published test keys.
+CONFORMANCE_KEYS: Final = KeyPolicy(accept_test_keys=True)
+
+
+@dataclass(frozen=True, slots=True, init=False)
+class _Verifier:
+    """What both verifiers hold, fixed when they are made: the resolver, the clock, and
+    the :class:`KeyPolicy` of the key ids they refuse."""
+
+    resolver: KeyResolver
+    clock: Clock
+    keys: KeyPolicy
+
+    def __init__(
+        self, resolver: KeyResolver, *, clock: Clock = system_clock, keys: KeyPolicy = DEFAULT_KEYS
+    ) -> None:
+        if not isinstance(keys, KeyPolicy):
+            raise ConfigurationError(f"keys is a KeyPolicy, not {keys!r}")
+        object.__setattr__(self, "resolver", resolver)
+        object.__setattr__(self, "clock", clock)
+        object.__setattr__(self, "keys", keys)
+
+    def _now(self, now: UnixSeconds | None) -> UnixSeconds:
+        return self.clock() if now is None else now
+
+    async def _authenticate[M: (HTTPRequest, HTTPResponse), N: (str, str | None)](
+        self, message: M, selected: _Selected, keyid: KeyId, rules: Rules[M, N], now: UnixSeconds
+    ) -> _Authenticated:
+        """Resolve the key and verify the signature, with the library checking the
+        components ``rules`` require and the content they cover."""
+        member = selected.member
+        required = rules.components_for(message, member.label)
+        if keyid in self.keys.refused:
+            raise refuse(Refusal.REJECTED_KEY, f"key {keyid} is refused")
+        resolved = await self.resolver.resolve(selected.origin, keyid, now=now)
+        body = _covered_body(member, message.headers, rules.content(message))
+        result = _sig.verify(
+            message, member, resolved.public_key, require_components=required, body=body
+        )
+        return _Authenticated(selected.origin, result, resolved.directory)
+
+
+@dataclass(frozen=True, slots=True, init=False)
+class RequestVerifier(_Verifier):
+    """Confirms ``web-bot-auth`` request signatures. It is immutable.
+
+    ``resolver`` finds keys (usually a :class:`DirectoryResolver`).
+    ``identity`` is the verifier's own :class:`ServerIdentity`: a request
+    whose URL names any authority but
+    :attr:`ServerIdentity.request_authority` is refused with ``403``, so a
+    request signed for one server doesn't verify at another. ``nonces``
+    records nonces; share one store across every worker that verifies
+    requests for the same deployment (:class:`MemoryNonceStore` serves one
+    process). ``keys`` is the :class:`KeyPolicy`: the published test keys
+    are always refused (Web Bot Auth section 6.8), with any key ids it lists
+    on top; only a conformance run passes :data:`CONFORMANCE_KEYS`.
+    """
+
+    identity: ServerIdentity
+    nonces: NonceStore
+
+    def __init__(
+        self,
+        resolver: KeyResolver,
+        *,
+        identity: ServerIdentity,
+        nonces: NonceStore,
+        clock: Clock = system_clock,
+        keys: KeyPolicy = DEFAULT_KEYS,
+    ) -> None:
+        _Verifier.__init__(self, resolver, clock=clock, keys=keys)
+        object.__setattr__(self, "identity", identity)
+        object.__setattr__(self, "nonces", nonces)
+
+    async def verify(
+        self, request: HTTPRequest, *, now: UnixSeconds | None = None
+    ) -> VerifiedRequest:
+        """Verifies ``request``; raises :class:`WebBotAuthError` on failure, and logs it."""
+        at = self._now(now)
+
+        async def verify(selected: _Selected) -> VerifiedRequest:
+            _check_authority(request, self.identity)
+            keyid, nonce = _check_parameters(selected.member, REQUEST, at)
+            required = REQUEST.components_for(request, selected.member.label)
+            _check_components(selected.member, required, REQUEST)
+            authenticated = await self._authenticate(request, selected, keyid, REQUEST, at)
+            await self._record(authenticated, nonce, at)
+            return authenticated.request(nonce)
+
+        return await _logged("request", request, verify)
+
+    async def _record(self, verified: _Authenticated, nonce: str, now: UnixSeconds) -> None:
+        """Check the nonce: record it once for the origin, for the window plus the skew."""
+        ttl = Seconds(verified.result.expires - now + REQUEST.window.skew)
+        try:
+            recorded = await self.nonces.check_and_record(verified.origin, nonce, ttl)
+        except NonceStoreUnavailable as e:
+            raise refuse(
+                Refusal.NONCE_STORE_UNAVAILABLE, f"the nonce can't be recorded: {e}"
+            ) from e
+        if not recorded:
+            raise refuse(Refusal.NONCE_REPLAYED, f"nonce seen before for {verified.origin}")
+
+
+@dataclass(frozen=True, slots=True, init=False)
+class ResponseVerifier(_Verifier):
+    """Confirms ``web-bot-auth`` response signatures and their binding to the request.
+
+    When the request carried a ``web-bot-auth`` signature, the response must
+    cover ``"signature";req;key=<request label>``; otherwise it is refused, so
+    an unbound response never verifies. A responder names its own origin
+    (OpenProposal § 2.8.2), so by default the response must be signed by the
+    identity of the host the request went to. It is immutable. It takes the
+    ``resolver``, ``clock``, and ``keys`` a :class:`RequestVerifier` takes,
+    and refuses the published test keys the same way.
+    """
+
+    async def verify(
+        self,
+        response: HTTPResponse,
+        *,
+        expected_origin: ExpectedOrigin = SAME_ORIGIN,
+        now: UnixSeconds | None = None,
+    ) -> VerifiedResponse:
+        """Verifies ``response``; raises :class:`WebBotAuthError` on failure, and logs it.
+
+        ``response.request`` carries the request's URL and headers as sent,
+        including its own signature. ``expected_origin`` names whose signature
+        the response carries: :data:`SAME_ORIGIN` (the default), the identity
+        :meth:`Origin.of_url` gives for ``response.request.url``, whatever its
+        scheme and port; an :class:`Origin`; or ``None`` for any identity. A
+        signature by anyone else is refused ``origin-mismatch``.
+        """
+        if expected_origin not in (SAME_ORIGIN, None) and not isinstance(expected_origin, Origin):
+            raise TypeError(
+                f"expected_origin is an Origin, {SAME_ORIGIN!r}, or None, not {expected_origin!r}"
+            )
+        at = self._now(now)
+
+        async def verify(selected: _Selected) -> VerifiedResponse:
+            keyid, _ = _check_parameters(selected.member, RESPONSE, at)
+            required = RESPONSE.components_for(response, selected.member.label)
+            _check_components(selected.member, required, RESPONSE)
+            _check_signer(selected.origin, _expected_signer(response, expected_origin))
+            authenticated = await self._authenticate(response, selected, keyid, RESPONSE, at)
+            bound = web_bot_auth_label(response.request.headers) is not None
+            return authenticated.response(bound=bound)
+
+        return await _logged("response", response, verify)
+
+
+__all__ = [
+    "CONFORMANCE_KEYS",
+    "DEFAULT_KEYS",
+    "SAME_ORIGIN",
+    "ExpectedOrigin",
+    "KeyPolicy",
+    "RequestVerifier",
+    "ResponseVerifier",
+    "VerifiedRequest",
+    "VerifiedResponse",
+    "is_signed",
+]
diff --git a/tests/web_bot_auth/__init__.py b/tests/web_bot_auth/__init__.py
new file mode 100644
index 0000000..9ba577a
--- /dev/null
+++ b/tests/web_bot_auth/__init__.py
@@ -0,0 +1 @@
+"""Tests for iab_agentic_primitives.web_bot_auth."""
diff --git a/tests/web_bot_auth/conftest.py b/tests/web_bot_auth/conftest.py
new file mode 100644
index 0000000..b525052
--- /dev/null
+++ b/tests/web_bot_auth/conftest.py
@@ -0,0 +1,41 @@
+"""Fixtures for the Web Bot Auth tests: the published keys and the two verifiers.
+
+The dev group carries the ``wba`` libraries, so the suite always runs.
+"""
+
+import pytest
+
+from iab_agentic_primitives.web_bot_auth import Ed25519Key, RequestVerifier, ResponseVerifier
+
+from . import support
+from .support import buyer_key as _buyer
+from .support import other_key as _other
+from .support import request_verifier
+from .support import seller_key as _seller
+
+
+@pytest.fixture
+def buyer_key() -> Ed25519Key:
+    return _buyer()
+
+
+@pytest.fixture
+def other_key() -> Ed25519Key:
+    return _other()
+
+
+@pytest.fixture
+def seller_key() -> Ed25519Key:
+    return _seller()
+
+
+@pytest.fixture
+def verifier(buyer_key: Ed25519Key, other_key: Ed25519Key) -> RequestVerifier:
+    """The seller's verifier, over the directories of the buyer and the other origin."""
+    return request_verifier()
+
+
+@pytest.fixture
+def response_verifier() -> ResponseVerifier:
+    """The buyer's verifier of the seller's responses."""
+    return support.response_verifier()
diff --git a/tests/web_bot_auth/interop/.gitignore b/tests/web_bot_auth/interop/.gitignore
new file mode 100644
index 0000000..c2658d7
--- /dev/null
+++ b/tests/web_bot_auth/interop/.gitignore
@@ -0,0 +1 @@
+node_modules/
diff --git a/tests/web_bot_auth/interop/docs.mjs b/tests/web_bot_auth/interop/docs.mjs
new file mode 100644
index 0000000..4d6575c
--- /dev/null
+++ b/tests/web_bot_auth/interop/docs.mjs
@@ -0,0 +1,36 @@
+/**
+ * The message documents at the harness's boundary.
+ *
+ * The vector files and the adapter protocol write a message's field lines as
+ * [name, value] pairs, in order, and its body as text, or as {"base64": ...}
+ * when the bytes aren't UTF-8. Inside the harness a message has a header
+ * object and a text body. fromWire reads the first form into the second, and
+ * toWire writes it back. Only a "headers" or "body" member that is a document
+ * part changes; a scenario's after_signing edits stay as written.
+ */
+
+const isPlain = v => v !== null && typeof v === 'object' && !Array.isArray(v);
+
+/** The header object of [name, value] pairs; a repeated name's values join with ", ". */
+function headerObject(pairs) {
+  const out = {};
+  for (const [name, value] of pairs) out[name] = name in out ? `${out[name]}, ${value}` : value;
+  return out;
+}
+
+export function fromWire(value) {
+  if (Array.isArray(value)) return value.map(fromWire);
+  if (!isPlain(value)) return value;
+  return Object.fromEntries(Object.entries(value).map(([k, v]) => {
+    if (k === 'headers' && Array.isArray(v)) return [k, headerObject(v)];
+    if (k === 'body' && isPlain(v) && typeof v.base64 === 'string') return [k, Buffer.from(v.base64, 'base64').toString('utf8')];
+    return [k, fromWire(v)];
+  }));
+}
+
+export function toWire(value) {
+  if (Array.isArray(value)) return value.map(toWire);
+  if (!isPlain(value)) return value;
+  return Object.fromEntries(Object.entries(value).map(([k, v]) =>
+    k === 'headers' && isPlain(v) ? [k, Object.entries(v)] : [k, toWire(v)]));
+}
diff --git a/tests/web_bot_auth/interop/judge.mjs b/tests/web_bot_auth/interop/judge.mjs
new file mode 100644
index 0000000..92937f3
--- /dev/null
+++ b/tests/web_bot_auth/interop/judge.mjs
@@ -0,0 +1,423 @@
+/**
+ * The judge: Cloudflare's `web-bot-auth` and `http-message-sig` at the versions
+ * pinned in package.json, run two ways.
+ *
+ * - Bare: the library as shipped, with only the resolver every caller writes:
+ *   derive the origin of the covered Signature-Agent member, read that origin's
+ *   well-known directory, and return the key whose thumbprint is `keyid`.
+ * - Policy: the library with the profile's rules from policy.mjs in its hooks.
+ *
+ * Run directly, this file is an adapter (see conformance/PROTOCOL.md) that signs with the
+ * library and verifies with the policy, so `run.mjs --self` grades the judge
+ * through the same protocol as the Python implementation.
+ */
+import { createHash, randomBytes } from 'node:crypto';
+import { pathToFileURL } from 'node:url';
+import { component, createSignature, verifySignature } from 'http-message-sig';
+import { parseDictionary } from 'structured-headers';
+import { fromWire, toWire } from './docs.mjs';
+import { generateNonce, sign, verify } from 'web-bot-auth';
+import { signerFromJWK, verifierFromJWK } from 'web-bot-auth/crypto';
+import * as policy from './policy.mjs';
+
+const { header } = policy;
+const fields = headers => Object.entries(headers).map(([name, value]) => ({ name: name.toLowerCase(), value }));
+/**
+ * The URL as it travels on the wire: what a native Request's `url` holds, the
+ * WHATWG serialization, without the fragment that never goes on the wire. A
+ * Worker signing `new Request(url)` signs this as `@target-uri`, and a Worker
+ * verifying reads it from the request it received. A malformed URL is passed
+ * as written, for http-message-sig to refuse.
+ */
+export const onTheWire = url => {
+  try {
+    const parsed = new URL(url);
+    parsed.hash = '';
+    return parsed.href;
+  } catch {
+    return url;
+  }
+};
+const message = r => ({ kind: 'request', method: r.method, targetUri: onTheWire(r.url), fields: fields(r.headers) });
+const responseMessage = (response, request) => ({ kind: 'response', status: response.status, fields: fields(response.headers), request: message(request) });
+const digest = body => `sha-256=:${createHash('sha256').update(body).digest('base64')}:`;
+const publicJwk = ({ d, p, q, dp, dq, qi, ...pub }) => pub;
+const failure = (error, kind) => ({
+  ok: false,
+  status: policy.statusOf(error),
+  rule: policy.ruleOf(error, kind),
+  error: `${error?.message ?? error}${error?.cause ? `: ${error.cause.message ?? error.cause}` : ''}`,
+});
+const verifierOrUndefined = jwk => verifierFromJWK(jwk).catch(() => undefined);
+
+const directoryMessage = (origin, response) => ({
+  kind: 'response',
+  status: response.status,
+  fields: fields(response.headers),
+  request: { kind: 'request', method: 'GET', targetUri: policy.directoryUrl(origin), fields: [] },
+});
+
+// ── Directories ───────────────────────────────────────────────────────────
+
+/** Verifies a signed directory response; returns { ok, keyids } or a refusal. */
+export async function verifyDirectory({ origin, response, now }, { bare = false } = {}) {
+  try {
+    const keys = JSON.parse(response.body).keys ?? [];
+    const signed = directoryMessage(origin, response);
+    const keyids = [];
+    if (bare) {
+      // Every signature in the response verifies with the key the body gives for its keyid.
+      const input = parseDictionary(header(response.headers, 'signature-input') ?? '');
+      const verifiers = (await Promise.all(keys.map(verifierOrUndefined))).filter(Boolean);
+      for (const [label, [, params]] of input) {
+        const verifier = verifiers.find(v => v.keyid === params.get('keyid'));
+        if (verifier === undefined) throw new Error(`no key ${params.get('keyid')} in the directory`);
+        await verifySignature(signed, {
+          label,
+          policy: { algorithms: ['ed25519', 'rsa-pss-sha512'], now, requiredComponents: [], requiredParameters: [] },
+          resolveVerifier: async () => verifier,
+        });
+        keyids.push(verifier.keyid);
+      }
+      if (keyids.length === 0) throw new Error('the directory response carries no signature');
+      return { ok: true, keyids };
+    }
+    policy.checkDirectoryResponse(response);
+    const input = parseDictionary(header(response.headers, 'signature-input') ?? '');
+    for (const verifier of await Promise.all(keys.map(verifierOrUndefined))) {
+      if (!policy.usable(verifier)) continue;
+      await verifySignature(signed, {
+        label: policy.directoryLabelFor(input, verifier.keyid),
+        policy: policy.directorySignaturePolicy(now),
+        resolveVerifier: async () => verifier,
+      });
+      keyids.push(verifier.keyid);
+    }
+    policy.checkDirectoryBody(response, keyids);
+    return { ok: true, keyids: keyids.sort() };
+  } catch (e) {
+    return failure(e, 'directory');
+  }
+}
+
+async function resolveKey(directories, entry, keyid, now, bare, headers) {
+  if (!bare) policy.checkSignatureAgent(entry, headers);
+  // The verifier derives the origin's well-known directory from the member value (WBA section 5.5).
+  const origin = new URL(entry.uri).origin;
+  const response = directories[origin];
+  if (response === undefined) throw new policy.PolicyError(403, 'directory-unavailable', `no directory at ${origin}`);
+  if (!bare) {
+    const checked = await verifyDirectory({ origin, response, now });
+    if (!checked.ok) throw new policy.PolicyError(403, checked.rule, `directory of ${entry.uri}: ${checked.error}`);
+    policy.checkNotTestKey(keyid);
+  }
+  for (const jwk of JSON.parse(response.body).keys ?? []) {
+    const verifier = await verifierOrUndefined(jwk);
+    if (verifier?.keyid === keyid && (bare || policy.usable(verifier))) return verifier;
+  }
+  throw new policy.PolicyError(403, 'key-not-found', `key ${keyid} is not in the directory of ${entry.uri}`);
+}
+
+// ── Requests ──────────────────────────────────────────────────────────────
+
+async function verifyOne(request, directories, now, bare, replay, authority) {
+  if (!bare) policy.checkAuthority(request, authority);
+  const label = bare ? undefined : policy.selectLabel(request);
+  const result = await verify(message(request), {
+    now: new Date(now * 1000),
+    label,
+    algorithms: bare ? undefined : policy.ALGORITHMS,
+    clockSkew: bare ? undefined : policy.CLOCK_SKEW,
+    resolver: async candidate => {
+      if (candidate.signatureAgent === undefined) throw new policy.PolicyError(403, 'signature-agent-not-covered', 'no covered Signature-Agent member');
+      return resolveKey(directories, candidate.signatureAgent, candidate.keyid, now, bare, request.headers);
+    },
+    validate: bare ? undefined : r => policy.validate(r, request),
+  });
+  // Both value forms name the origin; the bare resolver derives it the same way.
+  const identity = new URL(result.signatureAgent.uri).origin;
+  if (!bare) replay.check(identity, result.nonce);
+  return { ok: true, identity, keyid: result.keyid };
+}
+
+/**
+ * Verifies `request` after verifying each of `prior` with the same replay
+ * store, so a replay is built black-box. Returns { ok, identity, keyid } or a
+ * refusal with its status.
+ */
+export async function verifyRequest({ request, authority, directories, now, prior = [] }, { bare = false } = {}) {
+  const replay = new policy.ReplayStore();
+  for (const [i, earlier] of prior.entries()) {
+    try {
+      await verifyOne(earlier, directories, now, bare, replay, authority);
+    } catch (e) {
+      return { ...failure(e, 'request'), rule: `prior-${i}` };
+    }
+  }
+  try {
+    return await verifyOne(request, directories, now, bare, replay, authority);
+  } catch (e) {
+    return failure(e, 'request');
+  }
+}
+
+// ── Responses ─────────────────────────────────────────────────────────────
+
+/** The Signature-Agent member a response signature covers, as the bare resolver reads it. */
+function coveredAgent(response, candidate) {
+  const covered = candidate.components.find(c => c.name === 'signature-agent');
+  const agents = parseDictionary(header(response.headers, 'signature-agent') ?? '');
+  const member = agents.get(covered?.parameters?.key ?? [...agents.keys()][0]);
+  if (member === undefined) throw new Error('no covered Signature-Agent member');
+  const type = member[1].get('type');
+  return { label: covered?.parameters?.key, uri: member[0], type: type === undefined ? 'directory' : String(type) };
+}
+
+/**
+ * Verifies a response to `request` with http-message-sig: web-bot-auth 0.2.0
+ * has no response verifier. Bare: any one signature, no required components.
+ * Policy: the profile's response rules, including the request binding.
+ */
+export async function verifyResponse({ request, response, directories, now, expected_origin }, { bare = false } = {}) {
+  try {
+    const label = bare ? undefined : policy.selectLabel(response);
+    let identity;
+    let keyid;
+    const verified = await verifySignature(responseMessage(response, request), {
+      label,
+      policy: bare
+        ? { algorithms: ['ed25519', 'rsa-pss-sha512'], now, requiredComponents: [], requiredParameters: [] }
+        : policy.responsePolicy(response, request, label, now),
+      resolveVerifier: async candidate => {
+        const entry = coveredAgent(response, candidate);
+        identity = new URL(entry.uri).origin;
+        keyid = candidate.parameters.keyid;
+        return resolveKey(directories, entry, keyid, now, bare, response.headers);
+      },
+    });
+    if (!bare && expected_origin !== undefined && identity !== expected_origin) {
+      throw new policy.PolicyError(403, 'origin-mismatch', `the response is from ${identity}, not ${expected_origin}`);
+    }
+    return { ok: true, identity, keyid, bound: verified.components.some(c => c.name === 'signature' && c.parameters.req === true) };
+  } catch (e) {
+    return failure(e, 'response');
+  }
+}
+
+// ── Signing ───────────────────────────────────────────────────────────────
+
+/** Signs a request with the library's own `sign()`, with the options the profile needs. */
+export async function signRequest({ key, origin, request, now, label = 'sig1', form = 'url' }) {
+  // form 'url' sends the key directory URL (draft -01); form 'origin' sends the bare origin (draft -00).
+  const value = form === 'origin' ? origin : `${origin}${policy.WELL_KNOWN}`;
+  const headers = { ...request.headers, 'signature-agent': `${label}="${value}"` };
+  const additionalComponents = ['@method', '@target-uri'];
+  if (request.body) {
+    headers['content-digest'] = digest(request.body);
+    additionalComponents.push('content-type', 'content-digest');
+  }
+  const signature = await sign(message({ ...request, headers }), {
+    signer: await signerFromJWK(key),
+    created: new Date(now * 1000),
+    expires: new Date((now + policy.MAX_LIFETIME) * 1000),
+    nonce: generateNonce(),
+    label,
+    additionalComponents,
+  });
+  return { ...request, headers: { ...headers, 'signature-input': signature.signatureInput, signature: signature.signature } };
+}
+
+/** Signs a response to `request` with http-message-sig, under the profile's response rules. */
+export async function signResponse({ key, origin, request, response, now, label = 'sig1', components, parameters = {}, after_signing = {} }) {
+  const headers = { ...response.headers, 'signature-agent': `${label}="${origin}${policy.WELL_KNOWN}"` };
+  if (response.body) headers['content-digest'] = digest(response.body);
+  const signer = await signerFromJWK(key);
+  const ids = components
+    ? components.map(c => parseComponent(c.replace('{label}', label).replace('{request_label}', policy.requestLabel(request) ?? 'sig1')))
+    : policy.responseRequiredComponents(response, request, label);
+  const out = await createSignature(responseMessage({ ...response, headers }, request), {
+    label,
+    components: ids,
+    parameters: {
+      created: now + (parameters.created ?? 0),
+      expires: now + (parameters.expires ?? policy.MAX_LIFETIME),
+      keyid: signer.keyid,
+      alg: signer.algorithm,
+      tag: parameters.tag ?? 'web-bot-auth',
+    },
+    signer,
+  });
+  const signed = { ...response, headers: { ...headers, 'signature-input': out.signatureInput, signature: out.signature } };
+  return { ...signed, status: after_signing.status ?? signed.status, body: signed.body + (after_signing.append_to_body ?? '') };
+}
+
+/**
+ * Signs a key directory response per WBA Appendix B.1. The options build the
+ * directory scenarios in scenarios.json: `authority` signs for another host,
+ * `parameters` moves `created` and `expires` (offsets from `now`),
+ * `components` replaces the covered components, `unsigned_keys` adds public
+ * keys that do not sign, `content_type` changes the media type, and
+ * `after_signing.append_to_body` changes the body after signing.
+ */
+/** The profile's own directory signing: created now, a day's lifetime, and max-age 300. */
+export const PROFILE_DIRECTORY = { parameters: { created: 0, expires: 86400 }, max_age: 300 };
+
+export async function signDirectory({ keys, origin, now, authority, parameters = {}, components, unsigned_keys = [], content_type, after_signing = {}, defaults = PROFILE_DIRECTORY }) {
+  const published = [];
+  for (const key of keys) published.push({ ...publicJwk(key), kid: (await signerFromJWK(key)).keyid, use: 'sig' });
+  const body = JSON.stringify({ keys: [...published, ...unsigned_keys] }, null, 2);
+  const base = {
+    'content-type': content_type ?? policy.DIRECTORY_MEDIA_TYPE,
+    'cache-control': `max-age=${defaults.max_age}`,
+    'content-digest': digest(body),
+  };
+  const inputs = [];
+  const signatures = [];
+  for (const [i, key] of keys.entries()) {
+    const signer = await signerFromJWK(key);
+    const out = await createSignature(directoryMessage(authority ? `https://${authority}` : origin, { status: 200, headers: base }), {
+      label: `key${i + 1}`,
+      components: (components ?? ['@authority;req', 'content-digest']).map(parseComponent),
+      parameters: {
+        created: now + (parameters.created ?? defaults.parameters.created),
+        expires: now + (parameters.expires ?? defaults.parameters.expires),
+        keyid: signer.keyid,
+        alg: signer.algorithm,
+        tag: policy.DIRECTORY_TAG,
+      },
+      signer,
+    });
+    inputs.push(out.signatureInput);
+    signatures.push(out.signature);
+  }
+  const headers = keys.length === 0 ? base : { ...base, 'signature-input': inputs.join(', '), signature: signatures.join(', ') };
+  return { url: policy.directoryUrl(origin), status: 200, headers, body: body + (after_signing.append_to_body ?? '') };
+}
+
+/** `@authority;req` or `signature-agent;key=sig1`, as scenarios.json spells a component. */
+export function parseComponent(id) {
+  const [name, ...params] = id.split(';');
+  if (params.length === 0) return name;
+  return component(name, Object.fromEntries(params.map(p => (p.includes('=') ? p.split('=') : [p, true]))));
+}
+
+const NONCE_ENCODINGS = {
+  base64url: bytes => bytes.toString('base64url'),
+  base64: bytes => bytes.toString('base64'),
+  'base64url-padded': bytes => `${bytes.toString('base64url')}${'='.repeat((4 - (bytes.toString('base64url').length % 4)) % 4)}`,
+};
+function nonceValue(spec) {
+  if (!spec || typeof spec !== 'object') return spec;
+  for (;;) {
+    const value = NONCE_ENCODINGS[spec.encoding](randomBytes(spec.bytes));
+    // Padded base64url with no '-' or '_' is also canonical padded base64, which the profile accepts.
+    if (spec.encoding !== 'base64url-padded' || /[-_]/.test(value)) return value;
+  }
+}
+
+/**
+ * Signs one request scenario from scenarios.json at `now`. http-message-sig
+ * signs any component and parameter set, so a scenario can carry what the
+ * profile refuses. `keys` maps a kid to its private JWK.
+ */
+export async function signScenario(scenarios, scenario, keys, now) {
+  const { signer: who, requests, components: defaultComponents, parameters: defaultParameters } = scenarios;
+  const base = requests[scenario.base];
+  const label = scenario.label ?? 'sig1';
+  const headers = { ...base.headers, 'signature-agent': scenario.signature_agent ?? `${label}="${who.signature_agent}"` };
+  if (base.body) headers['content-digest'] = digest(base.body);
+  const request = { ...base, headers };
+  const first = await signOne(request, {
+    key: keys[who.kid],
+    label,
+    components: scenario.components ?? defaultComponents[scenario.base].map(c => c.replace('{label}', label)),
+    parameters: { ...defaultParameters, ...scenario.parameters },
+    now,
+  });
+  let signed = first;
+  if (scenario.extra_signature) {
+    const extra = scenario.extra_signature;
+    const second = await signOne(request, { key: keys[extra.kid], label: extra.label, components: extra.components, parameters: extra.parameters, now });
+    signed = { signatureInput: `${first.signatureInput}, ${second.signatureInput}`, signature: `${first.signature}, ${second.signature}` };
+  }
+  const after = scenario.after_signing ?? {};
+  // append_members adds raw members, so a scenario can carry a member the library would not sign.
+  const append = (name, value) => (after.append_members?.[name] ? `${value}, ${after.append_members[name]}` : value);
+  return {
+    ...request,
+    headers: {
+      ...headers,
+      'signature-input': append('signature-input', signed.signatureInput),
+      signature: append('signature', signed.signature),
+      ...after.headers,
+    },
+    body: base.body + (after.append_to_body ?? ''),
+  };
+}
+
+/** Signs one response scenario at `now`: returns { request, response }. */
+export async function signResponseScenario(scenarios, scenario, keys, now) {
+  const kind = scenario.request ?? 'bound';
+  const request = kind === 'unbound' ? { ...scenarios.requests.post } : await signScenario(scenarios, { base: 'post' }, keys, now);
+  const response = await signResponse({
+    key: keys[scenarios.responder.kid],
+    origin: scenarios.responder.identity,
+    request,
+    response: scenarios.response,
+    now,
+    components: scenario.components ?? scenarios.response_components[kind],
+    parameters: { ...scenarios.response_parameters, ...scenario.parameters },
+    after_signing: scenario.after_signing,
+  });
+  const requestHeaders = { ...request.headers };
+  for (const [name, value] of Object.entries(scenario.after_signing?.request_headers ?? {})) {
+    for (const k of Object.keys(requestHeaders)) if (k.toLowerCase() === name.toLowerCase()) delete requestHeaders[k];
+    requestHeaders[name] = value;
+  }
+  return { request: { ...request, headers: requestHeaders }, response };
+}
+
+async function signOne(request, { key, label, components, parameters, now }) {
+  const real = await signerFromJWK(key);
+  const claimed = parameters.alg === undefined ? real.algorithm : parameters.alg;
+  // A claimed alg other than the key's signs with the key and claims the other value.
+  const signer = claimed && claimed !== real.algorithm ? { algorithm: claimed, keyid: real.keyid, sign: d => real.sign(d) } : real;
+  const values = {
+    created: parameters.created === null ? null : now + parameters.created,
+    expires: parameters.expires === null ? null : now + parameters.expires,
+    nonce: nonceValue(parameters.nonce),
+    keyid: parameters.keyid === undefined ? real.keyid : parameters.keyid,
+    alg: claimed,
+    tag: parameters.tag,
+  };
+  return createSignature(message(request), {
+    label,
+    components: components.map(parseComponent),
+    parameters: Object.fromEntries(Object.entries(values).filter(([, v]) => v !== null && v !== undefined)),
+    signer,
+  });
+}
+
+// ── Adapter entry point ───────────────────────────────────────────────────
+
+const OPERATIONS = {
+  sign_request: signRequest,
+  sign_directory: signDirectory,
+  sign_response: signResponse,
+  verify_request: op => verifyRequest(op),
+  verify_directory: op => verifyDirectory(op),
+  verify_response: op => verifyResponse(op),
+};
+
+if (process.argv[1] !== undefined && import.meta.url === pathToFileURL(process.argv[1]).href) {
+  let input = '';
+  for await (const chunk of process.stdin) input += chunk;
+  const op = fromWire(JSON.parse(input));
+  let out;
+  try {
+    out = await OPERATIONS[op.op](op);
+  } catch (e) {
+    out = { ok: false, status: null, rule: 'adapter-error', error: String(e?.stack ?? e) };
+  }
+  process.stdout.write(JSON.stringify(toWire(out)));
+}
diff --git a/tests/web_bot_auth/interop/package-lock.json b/tests/web_bot_auth/interop/package-lock.json
new file mode 100644
index 0000000..dd28ee0
--- /dev/null
+++ b/tests/web_bot_auth/interop/package-lock.json
@@ -0,0 +1,57 @@
+{
+  "name": "iab-wba-interop",
+  "version": "0.0.0",
+  "lockfileVersion": 3,
+  "requires": true,
+  "packages": {
+    "": {
+      "name": "iab-wba-interop",
+      "version": "0.0.0",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "http-message-sig": "0.3.0",
+        "structured-headers": "2.0.3",
+        "web-bot-auth": "0.2.0"
+      },
+      "engines": {
+        "node": ">=20"
+      }
+    },
+    "node_modules/http-message-sig": {
+      "version": "0.3.0",
+      "resolved": "https://registry.npmjs.org/http-message-sig/-/http-message-sig-0.3.0.tgz",
+      "integrity": "sha512-ossX5ZDDCRD+YtMzryp3gCg+5wqLFes1RVChEFmEE9Bzbd49Ts2IIIvFnTst/mYWx0ivrxrTTPsIIKKJ07s7+w==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "structured-headers": "2.0.3"
+      }
+    },
+    "node_modules/jsonwebkey-thumbprint": {
+      "version": "0.1.0",
+      "resolved": "https://registry.npmjs.org/jsonwebkey-thumbprint/-/jsonwebkey-thumbprint-0.1.0.tgz",
+      "integrity": "sha512-4m/gJEUQH8N2NfvZFjCL8/E+vlt0FlrmHoR4T93CEXQRkC64qwRi6oQri4/eqLVXqEqXYCss0+Q7pLx6vJBqzw==",
+      "license": "Apache-2.0"
+    },
+    "node_modules/structured-headers": {
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/structured-headers/-/structured-headers-2.0.3.tgz",
+      "integrity": "sha512-4g5yxhlDMClRwCcfKfLeS7Z8yAVdOWGDADwm80Poh1iReU2KVKLGBlqwpHWJ2qovq0+ZIf1atAEO1eua2o9Rgg==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=18",
+        "npm": ">=6"
+      }
+    },
+    "node_modules/web-bot-auth": {
+      "version": "0.2.0",
+      "resolved": "https://registry.npmjs.org/web-bot-auth/-/web-bot-auth-0.2.0.tgz",
+      "integrity": "sha512-3DJ72ZhWK4a3yCHCClF6q32g03X37DJlpyASYeBroGTRj/qFkHNcPwkESc3FLigjW6NOWF6MR+Hat9AfOqqtAQ==",
+      "license": "Apache-2.0",
+      "dependencies": {
+        "http-message-sig": "^0.3.0",
+        "jsonwebkey-thumbprint": "^0.1.0",
+        "structured-headers": "2.0.3"
+      }
+    }
+  }
+}
diff --git a/tests/web_bot_auth/interop/package.json b/tests/web_bot_auth/interop/package.json
new file mode 100644
index 0000000..909dc38
--- /dev/null
+++ b/tests/web_bot_auth/interop/package.json
@@ -0,0 +1,16 @@
+{
+  "name": "iab-wba-interop",
+  "version": "0.0.0",
+  "private": true,
+  "description": "Grades the Python Web Bot Auth profile implementation against Cloudflare's web-bot-auth library.",
+  "license": "Apache-2.0",
+  "type": "module",
+  "engines": {
+    "node": ">=20"
+  },
+  "dependencies": {
+    "http-message-sig": "0.3.0",
+    "structured-headers": "2.0.3",
+    "web-bot-auth": "0.2.0"
+  }
+}
diff --git a/tests/web_bot_auth/interop/policy.mjs b/tests/web_bot_auth/interop/policy.mjs
new file mode 100644
index 0000000..abce58f
--- /dev/null
+++ b/tests/web_bot_auth/interop/policy.mjs
@@ -0,0 +1,333 @@
+/**
+ * The profile's rules, written as the hooks that Cloudflare's `web-bot-auth`
+ * and `http-message-sig` libraries expose.
+ *
+ * The library enforces the Web Bot Auth (WBA) rules itself. This file holds only
+ * what the profile adds, one section per rule in WEB_BOT_AUTH.md ("Profile
+ * rules"). A reviewer reads this file to see everything the profile adds to WBA.
+ *
+ * Some rules are WBA MUSTs that the pinned library does not enforce (an `https`
+ * origin, no path in the origin, a member keyed to the signature label, the
+ * directory media type). They live here until the library enforces them; the
+ * harness's tier check reports the day it does.
+ *
+ * Response signatures are an OpenProposal addition: web-bot-auth 0.2.0 has no
+ * response verifier, so the judge verifies them with `http-message-sig`.
+ */
+import { createHash } from 'node:crypto';
+import { component, isSignatureError } from 'http-message-sig';
+import { parseDictionary } from 'structured-headers';
+import { HTTP_MESSAGE_SIGNATURES_DIRECTORY, HTTP_MESSAGE_SIGNATURE_TAG } from 'web-bot-auth';
+
+/**
+ * A refusal with the status the profile answers (rule "Failures"). `rule` is a
+ * name from refusals.json, the vocabulary the Python implementation's Refusal
+ * enum generates, so the harness compares the two verdicts rule by rule.
+ */
+export class PolicyError extends Error {
+  constructor(status, rule, message) {
+    super(message);
+    this.status = status;
+    this.rule = rule;
+  }
+}
+const refuse = (rule, message) => {
+  throw new PolicyError(403, rule, message);
+};
+
+export const header = (headers, name) => Object.entries(headers).find(([k]) => k.toLowerCase() === name)?.[1];
+const componentName = c => (typeof c === 'string' ? c : c.name);
+
+// ── Identity ──────────────────────────────────────────────────────────────
+// The library checks the tag, the thumbprint keyid, and that exactly one
+// `signature-agent` member is covered. The profile adds the value rule: the
+// member value is exactly the key directory URL
+// `https://<host>/.well-known/http-message-signatures-directory` (draft -01
+// fetches it directly) or exactly the origin `https://<host>` (the draft -00
+// form), with a lowercase host and no port, query, fragment, or userinfo. Both
+// name the origin `https://<host>`. A member that carries parameters is
+// ignored (draft -01 section 5.2.1). The library accepts `http`
+// (cloudflare/web-bot-auth#162) and does not check the rest.
+
+const HOST = String.raw`(?:\[[0-9a-f:.]+\]|[a-z0-9](?:[a-z0-9.-]*[a-z0-9.])?)`;
+const VALUE = new RegExp(`^https://(${HOST})(?:${HTTP_MESSAGE_SIGNATURES_DIRECTORY.replace(/[.]/g, '\\.')})?$`);
+
+/** The origin a Signature-Agent value names, or undefined when the value breaks the rule. */
+export function originOfValue(value) {
+  const match = VALUE.exec(value);
+  return match ? `https://${match[1]}` : undefined;
+}
+
+/** Signature-Agent members without parameters; a member with parameters is ignored. */
+export function agentMembers(headers) {
+  const agents = parseDictionary(header(headers, 'signature-agent') ?? '');
+  return new Map([...agents].filter(([, [, params]]) => params.size === 0));
+}
+
+/** Checks the covered Signature-Agent member before its directory is read. */
+export function checkSignatureAgent(entry, headers) {
+  const all = parseDictionary(header(headers, 'signature-agent') ?? '');
+  if (all.get(entry.label)?.[1]?.size > 0) refuse('signature-agent-parameters', `Signature-Agent member ${entry.label} carries parameters`);
+  if (originOfValue(entry.uri) === undefined) refuse('signature-agent-value', `Signature-Agent ${entry.uri} is not https://<host>${HTTP_MESSAGE_SIGNATURES_DIRECTORY} or https://<host>`);
+}
+
+/** The covered member is the one keyed to the signature's label (WBA 5.2.1). */
+function checkMemberKeyedToLabel(result) {
+  const member = result.components.find(c => componentName(c) === 'signature-agent');
+  if (member?.parameters?.key !== result.label) {
+    refuse('signature-agent-missing', `covered Signature-Agent member ${member?.parameters?.key} is not keyed to label ${result.label}`);
+  }
+}
+
+// ── Authority ─────────────────────────────────────────────────────────────
+// The request's @authority is the verifier's own configured authority, never
+// the Host it was sent (OpenProposal § 2.8.4 step 5). The library has no
+// such check.
+
+export function checkAuthority(request, authority) {
+  if (authority !== undefined && new URL(request.url).host !== authority) {
+    refuse('authority', `the request is for ${new URL(request.url).host}, not ${authority}`);
+  }
+}
+
+// ── Request components ────────────────────────────────────────────────────
+
+export function requiredComponents(request) {
+  const names = ['@method', '@target-uri', '@authority'];
+  if (request.body) names.push('content-type', 'content-digest');
+  return names;
+}
+
+/** True when the Content-Digest field's sha-256 member is the digest of `body` (RFC 9530). */
+export function digestMatches(field, body) {
+  if (field === undefined) return false;
+  let member;
+  try {
+    member = parseDictionary(field).get('sha-256');
+  } catch {
+    return false;
+  }
+  if (!member || !(member[0] instanceof ArrayBuffer)) return false;
+  return Buffer.from(member[0]).equals(createHash('sha256').update(body).digest());
+}
+
+// ── Signature parameters ──────────────────────────────────────────────────
+// The library requires created, expires, keyid, alg, and tag, and checks that a
+// nonce is 64 bytes as unpadded base64url or canonical padded base64
+// (`validateNonce`). The profile adds that a request's nonce is present.
+
+export const ALGORITHMS = ['ed25519'];
+export const MAX_LIFETIME = 300;
+export const CLOCK_SKEW = 60;
+
+/** The `validate` hook for `verify()`: the request-level rules above. */
+export function validate(result, request) {
+  checkMemberKeyedToLabel(result);
+  const covered = result.components.map(componentName);
+  for (const name of requiredComponents(request)) {
+    if (!covered.includes(name)) refuse('components', `${name} is not covered`);
+  }
+  if (request.body && !digestMatches(header(request.headers, 'content-digest'), request.body)) {
+    refuse('content-digest', 'Content-Digest does not match the body');
+  }
+  if (typeof result.nonce !== 'string') refuse('nonce-missing', 'nonce is required on every signed request');
+  checkLifetime(result.parameters);
+  return true;
+}
+
+/** The one lifetime rule of a request or response signature: at most 300 s. */
+export function checkLifetime({ created, expires }) {
+  if (expires - created > MAX_LIFETIME) refuse('lifetime', `expires is more than ${MAX_LIFETIME} s after created`);
+}
+
+// ── Keys ──────────────────────────────────────────────────────────────────
+// Key lookup is by (origin, keyid), never by keyid alone (WBA 5.4): the
+// resolver reads only the directory of the origin the covered member names.
+
+/** True for a key the profile uses: the library imports it and its algorithm is allowed. */
+export const usable = verifier => verifier !== undefined && ALGORITHMS.includes(verifier.algorithm);
+
+/** WBA section 6.8: verifiers SHOULD reject published test keys. The harness passes none here. */
+export function checkNotTestKey(keyid, rejectKids = []) {
+  if (rejectKids.includes(keyid)) refuse('rejected-key', `${keyid} is a published test key`);
+}
+
+// ── Directory responses ───────────────────────────────────────────────────
+// Served with the directory media type. One signature per Ed25519 key, covering
+// "@authority";req and content-digest, with created, expires, keyid, and the
+// directory tag. Keys the profile does not use, and their signatures, are
+// ignored (RFC 7517 section 5). Content-Digest matches the body (Appendix B.1).
+
+export const DIRECTORY_MEDIA_TYPE = 'application/http-message-signatures-directory+json';
+export const DIRECTORY_TAG = 'http-message-signatures-directory';
+
+/**
+ * The `verifySignature` policy for one directory signature (WBA Appendix B.1).
+ * The library applies `clockSkew` to both created and expires; the profile
+ * allows the skew on created only, so the hook refuses any expires before now.
+ */
+export const directorySignaturePolicy = now => ({
+  algorithms: ALGORITHMS,
+  now,
+  clockSkew: CLOCK_SKEW,
+  requiredComponents: [component('@authority', { req: true }), 'content-digest'],
+  requiredParameters: ['created', 'expires', 'keyid', 'tag'],
+  validate: v => {
+    if (v.parameters.expires < now) refuse('directory-window', 'the directory signature has expired');
+    return v.parameters.tag === DIRECTORY_TAG;
+  },
+});
+
+/** The label of the one signature by `keyid`, or a refusal. Labels by other keys are never read. */
+export function directoryLabelFor(signatureInput, keyid) {
+  const labels = [...signatureInput].filter(([, [, params]]) => params.get('keyid') === keyid).map(([label]) => label);
+  if (labels.length !== 1) refuse('directory-one-signature-per-key', `${labels.length} directory signatures by ${keyid}`);
+  return labels[0];
+}
+
+export function checkDirectoryBody(response, verifiedKeyids) {
+  if (!digestMatches(header(response.headers, 'content-digest'), response.body)) {
+    refuse('directory-content-digest', 'directory Content-Digest does not match the body');
+  }
+  if (verifiedKeyids.length === 0) refuse('directory-no-usable-key', 'the directory holds no Ed25519 key');
+}
+
+// ── Fetches ───────────────────────────────────────────────────────────────
+// The harness serves directories from data, so the network rules (HTTPS,
+// resolved-address checks, no redirects, size and time limits) and caching are
+// not exercised here; the Python unit tests grade them. The response-level
+// rules are.
+
+export const WELL_KNOWN = HTTP_MESSAGE_SIGNATURES_DIRECTORY;
+export const directoryUrl = origin => `${new URL(origin).origin}${HTTP_MESSAGE_SIGNATURES_DIRECTORY}`;
+
+export function checkDirectoryResponse(response) {
+  if (response.status !== 200) refuse('directory-status', `directory status ${response.status}`);
+  const type = header(response.headers, 'content-type')?.split(';')[0].trim().toLowerCase();
+  if (type !== DIRECTORY_MEDIA_TYPE) refuse('directory-media-type', `directory media type ${type}`);
+}
+
+// ── One signature ─────────────────────────────────────────────────────────
+// Exactly one web-bot-auth signature and one Signature-Agent member. Members
+// with other tags are not read. The library selects no label by tag and
+// requires one when a message carries several, so the profile selects it.
+
+/**
+ * Parses the three signature fields (`400` on failure), then returns the label
+ * of the one web-bot-auth signature. The library then checks every member's
+ * shape, whatever its tag (RFC 9421 sections 4.1 and 4.2).
+ */
+export function selectLabel(message) {
+  let input;
+  let agents;
+  try {
+    for (const name of ['signature', 'signature-input', 'signature-agent']) {
+      const value = header(message.headers, name);
+      if (value === undefined) refuse('signature-missing', `no ${name} field`);
+      const parsed = parseDictionary(value);
+      if (name === 'signature-input') input = parsed;
+      if (name === 'signature-agent') agents = parsed;
+    }
+  } catch (e) {
+    if (e instanceof PolicyError) throw e;
+    throw new PolicyError(400, 'parse', e.message);
+  }
+  const tagged = [...input].filter(([, [, params]]) => params.get('tag') === HTTP_MESSAGE_SIGNATURE_TAG).map(([label]) => label);
+  if (tagged.length === 0) refuse('signature-missing', 'no web-bot-auth signature');
+  if (tagged.length > 1) refuse('multiple-signatures', `${tagged.length} web-bot-auth signatures`);
+  const usable = [...agents].filter(([, [, params]]) => params.size === 0);
+  if (usable.length > 1) refuse('multiple-signature-agents', `${usable.length} Signature-Agent members`);
+  return tagged[0];
+}
+
+// ── Response signatures (OpenProposal addition) ───────────────────────────
+// @status, "@method";req, "@target-uri";req, "signature-agent";key=<label>;
+// with a body, content-type and content-digest; and, when the request carried
+// a web-bot-auth signature, "signature";req;key=<request label>. No nonce.
+
+/** The label of the request's one web-bot-auth signature, or undefined. */
+export function requestLabel(request) {
+  try {
+    return selectLabel(request);
+  } catch {
+    return undefined;
+  }
+}
+
+export function responseRequiredComponents(response, request, label) {
+  const out = ['@status', component('@method', { req: true }), component('@target-uri', { req: true }), component('signature-agent', { key: label })];
+  if (response.body) out.push('content-type', 'content-digest');
+  const bound = requestLabel(request);
+  if (bound !== undefined) out.push(component('signature', { req: true, key: bound }));
+  return out;
+}
+
+export const responsePolicy = (response, request, label, now) => ({
+  algorithms: ALGORITHMS,
+  now,
+  clockSkew: CLOCK_SKEW,
+  requiredComponents: responseRequiredComponents(response, request, label),
+  requiredParameters: ['created', 'expires', 'keyid', 'alg', 'tag'],
+  validate: v => {
+    if (v.parameters.tag !== HTTP_MESSAGE_SIGNATURE_TAG) refuse('signature-missing', `tag ${v.parameters.tag}`);
+    checkLifetime(v.parameters);
+    if (response.body && !digestMatches(header(response.headers, 'content-digest'), response.body)) {
+      refuse('content-digest', 'Content-Digest does not match the body');
+    }
+    return true;
+  },
+});
+
+// ── Failures ──────────────────────────────────────────────────────────────
+// 400 when a signature field does not parse, 429 for a reused nonce, 403
+// otherwise (WBA 5.3 and 5.4).
+
+/** The policy's own refusal behind `error`, if it carries one. */
+const policyCause = error => (error instanceof PolicyError ? error : error?.cause instanceof PolicyError ? error.cause : undefined);
+
+/**
+ * The library's errors, named in the vocabulary by what they report and the
+ * kind of message: `request` and `response` signatures, or a `directory`.
+ */
+const LIBRARY_RULES = [
+  [/created in the future/, { request: 'created-in-future', response: 'created-in-future', directory: 'directory-window' }],
+  [/has expired/, { request: 'expired', response: 'expired', directory: 'directory-window' }],
+  [/parameter alg is absent|Algorithm .* is not allowed/, { request: 'alg', response: 'alg', directory: 'directory-signature' }],
+  [/Required component "signature";/, { request: 'components', response: 'response-not-bound', directory: 'directory-components' }],
+  [/Required component/, { request: 'components', response: 'components', directory: 'directory-components' }],
+  [/cover exactly one signature-agent member/, { request: 'signature-agent-not-covered', response: 'signature-agent-not-covered', directory: 'directory-signature' }],
+  [/nonce/, { request: 'nonce-invalid', response: 'nonce-invalid', directory: 'directory-signature' }],
+];
+
+/** The vocabulary rule of a refusal `error` while verifying a message of `kind`. */
+export function ruleOf(error, kind) {
+  const own = policyCause(error);
+  if (own) return own.rule;
+  const text = `${error?.message ?? ''} ${error?.cause?.message ?? ''}`;
+  if (isSignatureError(error) && (error.code === 'MalformedField' || error.code === 'DuplicateLabel')) {
+    return kind === 'directory' ? 'directory-signature-parse' : 'parse';
+  }
+  for (const [pattern, rules] of LIBRARY_RULES) if (pattern.test(text)) return rules[kind];
+  return kind === 'directory' ? 'directory-signature' : 'signature-invalid';
+}
+
+export function statusOf(error) {
+  const cause = error?.cause;
+  if (error instanceof PolicyError) return error.status;
+  if (cause instanceof PolicyError) return cause.status;
+  if (isSignatureError(error) && (error.code === 'MalformedField' || error.code === 'DuplicateLabel')) return 400;
+  return 403;
+}
+
+// ── Replay protection ─────────────────────────────────────────────────────
+// A nonce seen before for the same identity is refused with 429.
+
+export class ReplayStore {
+  #seen = new Set();
+
+  check(identity, nonce) {
+    const entry = `${identity} ${nonce}`;
+    if (this.#seen.has(entry)) throw new PolicyError(429, 'nonce-replayed', `nonce seen before for ${identity}`);
+    this.#seen.add(entry);
+  }
+}
diff --git a/tests/web_bot_auth/interop/run.mjs b/tests/web_bot_auth/interop/run.mjs
new file mode 100644
index 0000000..d5fe11b
--- /dev/null
+++ b/tests/web_bot_auth/interop/run.mjs
@@ -0,0 +1,325 @@
+#!/usr/bin/env node
+/**
+ * Grades a Web Bot Auth implementation against the judge (judge.mjs), through
+ * the adapter protocol in src/iab_agentic_primitives/web_bot_auth/conformance/PROTOCOL.md.
+ *
+ *   node run.mjs --adapter "<command>" [--persistent] [--vectors <dir>] [--json <file>]
+ *   node run.mjs --self [--json <file>]
+ *
+ * Every check records three verdicts on the same message: the adapter's, the
+ * judge's (Cloudflare's library with the profile's rules), and the bare
+ * library's (Cloudflare's library as shipped). A check passes when:
+ *
+ * - the adapter and the judge both give the expected outcome: a pass, or a
+ *   refusal with the expected status and rule (refusals.json), and
+ * - for tier "wba", the bare library gives it too; for tier "profile", the
+ *   bare library gives the opposite outcome, so only the profile's rules
+ *   decide it.
+ *
+ * Suites:
+ *
+ * - vectors: the committed vectors, at their reference_now.
+ * - live: the adapter signs and the judge verifies; the judge signs and the
+ *   adapter verifies; tampered copies fail in both. Each target URI in
+ *   scenarios.json is a GET each side signs and the other verifies.
+ * - scenarios: the judge signs every scenario in scenarios.json, and the
+ *   adapter verifies it.
+ *
+ * A vector's kind says which operation grades it; nothing infers it. The exit
+ * code is 1 when any check fails.
+ */
+import { spawn, spawnSync } from 'node:child_process';
+import { readFileSync, readdirSync, writeFileSync } from 'node:fs';
+import { dirname, join } from 'node:path';
+import { createInterface } from 'node:readline';
+import { fileURLToPath } from 'node:url';
+import { parseArgs } from 'node:util';
+import { fromWire, toWire } from './docs.mjs';
+import * as judge from './judge.mjs';
+
+const HERE = dirname(fileURLToPath(import.meta.url));
+const { values: args } = parseArgs({
+  options: {
+    adapter: { type: 'string' },
+    persistent: { type: 'boolean', default: false },
+    self: { type: 'boolean', default: false },
+    vectors: { type: 'string', default: join(HERE, '../../../src/iab_agentic_primitives/web_bot_auth/vectors') },
+    json: { type: 'string' },
+  },
+});
+if (!args.self && !args.adapter) {
+  console.error('usage: run.mjs --adapter "<command>" [--persistent] | --self [--vectors <dir>] [--json <file>]');
+  process.exit(2);
+}
+const command = args.self ? `"${process.execPath}" "${join(HERE, 'judge.mjs')}"` : args.adapter;
+
+// ── Adapter ───────────────────────────────────────────────────────────────
+
+let persistent;
+if (args.persistent && !args.self) {
+  // One process for every operation: one JSON object per line each way.
+  const child = spawn(command, { shell: true, stdio: ['pipe', 'pipe', 'inherit'] });
+  const lines = createInterface({ input: child.stdout });
+  const waiting = [];
+  lines.on('line', line => waiting.shift()?.(line));
+  persistent = {
+    call: op =>
+      new Promise(resolve => {
+        waiting.push(resolve);
+        child.stdin.write(`${JSON.stringify(toWire(op))}\n`);
+      }),
+    close: () => child.stdin.end(),
+  };
+}
+
+async function adapter(op) {
+  if (args.self) {
+    const fn = { sign_request: judge.signRequest, sign_directory: judge.signDirectory, sign_response: judge.signResponse,
+      verify_request: judge.verifyRequest, verify_directory: judge.verifyDirectory, verify_response: judge.verifyResponse }[op.op];
+    try {
+      return await fn(op);
+    } catch (e) {
+      return { ok: false, status: null, rule: 'adapter-error', error: String(e) };
+    }
+  }
+  let out;
+  if (persistent) {
+    out = await persistent.call(op);
+  } else {
+    const r = spawnSync(command, { shell: true, input: JSON.stringify(toWire(op)), encoding: 'utf8', maxBuffer: 1 << 24 });
+    out = r.stdout || r.stderr || String(r.error);
+  }
+  try {
+    return fromWire(JSON.parse(out));
+  } catch {
+    return { ok: false, status: null, rule: 'adapter-crash', error: String(out).slice(0, 600) };
+  }
+}
+
+// ── Data ──────────────────────────────────────────────────────────────────
+
+const read = path => fromWire(JSON.parse(readFileSync(join(args.vectors, path), 'utf8')));
+const KEYS = read('keys.json').keys;
+const PRIVATE = Object.fromEntries(KEYS.map(k => [k.kid, { kty: k.kty, crv: k.crv, x: k.x, d: k._private_d_for_test_only }]));
+const SCENARIOS = read('scenarios.json');
+// The refusal vocabulary, generated from the Python Refusal enum. Every refusal either side gives is named in it.
+const RULES = new Map(read('refusals.json').refusals.map(r => [r.rule, r.status]));
+const SIGNER = SCENARIOS.signer;
+// What every directory scenario signs unless it moves it, as scenarios.json states it.
+const DIRECTORY_DEFAULTS = { parameters: SCENARIOS.directory_parameters, max_age: SCENARIOS.directory_max_age };
+const RESPONDER = SCENARIOS.responder;
+const vectors = dir =>
+  readdirSync(join(args.vectors, dir))
+    .filter(f => f.endsWith('.json'))
+    .sort()
+    .map(f => ({ id: `${dir}/${f.replace(/\.json$/, '')}`, ...read(join(dir, f)) }));
+
+// ── Grading ───────────────────────────────────────────────────────────────
+
+const checks = [];
+const describe = r => (r.ok ? `pass${r.identity ? ` as ${r.identity}` : ''}` : `${r.status ?? 'no status'} ${r.rule ?? ''}: ${r.error ?? ''}`.trim());
+const want = e => (e.ok ? `pass${e.identity ? ` as ${e.identity}` : ''}` : `${e.status} ${e.rule}`);
+/** A pass with the expected identity, or a refusal with the expected status and a rule of the vocabulary. */
+const meets = (expected, got) =>
+  expected.ok
+    ? got.ok === true && (expected.identity == null || got.identity === expected.identity)
+    : got.ok === false && got.status === expected.status && got.rule === expected.rule && RULES.get(got.rule) === got.status;
+const verdict = r => (r === undefined ? undefined : r.ok ? 'pass' : `${r.status ?? 'no status'} ${r.rule}`);
+const refused = rule => ({ ok: false, status: RULES.get(rule), rule });
+
+/**
+ * Records one check. `python` is the adapter's result, `cloudflare` the
+ * judge's, and `bare` the bare library's (undefined when the check has no
+ * bare verdict, such as an adapter-only replay).
+ */
+function record(suite, id, expected, { python, cloudflare, bare, tier }) {
+  const bareOk = bare === undefined || tier === undefined ? true : tier === 'wba' ? bare.ok === expected.ok : bare.ok !== expected.ok;
+  const ok = (python === undefined || meets(expected, python)) && (cloudflare === undefined || meets(expected, cloudflare)) && bareOk;
+  checks.push({
+    suite,
+    id,
+    tier,
+    ok,
+    expected: want(expected),
+    python: verdict(python),
+    cloudflare: verdict(cloudflare),
+    cloudflare_bare: verdict(bare),
+    detail: { python: python && describe(python), cloudflare: cloudflare && describe(cloudflare), bare: bare && describe(bare) },
+  });
+}
+
+async function signedDirectories(map, now) {
+  const out = {};
+  for (const [origin, kids] of Object.entries(map)) {
+    out[origin] = await judge.signDirectory({ keys: kids.map(k => PRIVATE[k]), origin, now });
+  }
+  return out;
+}
+
+async function verifyBoth(kind, op) {
+  const fn = { request: judge.verifyRequest, directory: judge.verifyDirectory, response: judge.verifyResponse }[kind];
+  return { cloudflare: await fn(op), bare: await fn(op, { bare: true }) };
+}
+
+// ── Vectors ───────────────────────────────────────────────────────────────
+
+async function runVectors() {
+  // Each vector carries the operation that grades it, ready to send as it is.
+  for (const v of [...vectors('positive'), ...vectors('negative')]) {
+    const kind = { verify_request: 'request', verify_response: 'response', verify_directory: 'directory' }[v.operation.op];
+    if (kind === undefined) throw new Error(`${v.id} has no verify operation`);
+    const { op: _, ...op } = v.operation;
+    record('vectors', v.id, v.expected, { python: await adapter(v.operation), ...(await verifyBoth(kind, op)), tier: v.tier });
+  }
+}
+
+// ── Live ──────────────────────────────────────────────────────────────────
+
+const tamperUrl = r => ({ ...r, url: `${r.url}${r.url.includes('?') ? '&' : '?'}t=1` });
+const tamperBody = r => ({ ...r, body: `${r.body} ` });
+
+async function runLive(now) {
+  const key = PRIVATE[SIGNER.kid];
+  const origin = SIGNER.identity;
+  const authority = SCENARIOS.verifier;
+  const ok = { ok: true, identity: origin };
+  const tampered = refused('signature-invalid');
+  const bodyChanged = refused('content-digest');
+  const verifyOp = (request, directories, extra = {}) => ({ request, authority, directories, now, ...extra });
+
+  const theirs = await adapter({ op: 'sign_directory', keys: [key], origin, now });
+  record('live', 'Python signs the directory, Cloudflare verifies', { ok: true }, { ...(await verifyBoth('directory', { origin, response: theirs, now })), tier: 'wba' });
+  const tamperedDirectory = { ...theirs, body: `${theirs.body}\n` };
+  record('live', 'Python signs the directory, body changed, both refuse', refused('directory-content-digest'), {
+    python: await adapter({ op: 'verify_directory', origin, response: tamperedDirectory, now }),
+    ...(await verifyBoth('directory', { origin, response: tamperedDirectory, now })),
+    tier: 'profile',
+  });
+  const ours = await judge.signDirectory({ keys: [key], origin, now });
+  record('live', 'Cloudflare signs the directory, Python verifies', { ok: true }, { python: await adapter({ op: 'verify_directory', origin, response: ours, now }) });
+
+  for (const [name, request] of Object.entries(SCENARIOS.requests)) {
+    const N = name.toUpperCase();
+    const signed = await adapter({ op: 'sign_request', key, origin, request, now });
+    const dirs = { [origin]: theirs };
+    record('live', `Python signs ${N}, Cloudflare verifies`, ok, { ...(await verifyBoth('request', verifyOp(signed, dirs))), tier: 'wba' });
+    const urlChanged = tamperUrl(signed);
+    record('live', `Python signs ${N}, URL changed, both refuse`, tampered, {
+      python: await adapter({ op: 'verify_request', ...verifyOp(urlChanged, dirs) }),
+      ...(await verifyBoth('request', verifyOp(urlChanged, dirs))),
+      tier: 'wba',
+    });
+    if (request.body) {
+      const changed = tamperBody(signed);
+      record('live', `Python signs ${N}, body changed, both refuse`, bodyChanged, {
+        python: await adapter({ op: 'verify_request', ...verifyOp(changed, dirs) }),
+        ...(await verifyBoth('request', verifyOp(changed, dirs))),
+        tier: 'profile',
+      });
+    }
+
+    const mine = await judge.signRequest({ key, origin, request, now, form: 'url' });
+    const mineDirs = { [origin]: ours };
+    record('live', `Cloudflare signs ${N} with the key URL, Python verifies`, ok, { python: await adapter({ op: 'verify_request', ...verifyOp(mine, mineDirs) }), ...(await verifyBoth('request', verifyOp(mine, mineDirs))), tier: 'wba' });
+    const mineOrigin = await judge.signRequest({ key, origin, request, now, form: 'origin' });
+    record('live', `Cloudflare signs ${N} with the bare origin, Python verifies`, ok, { python: await adapter({ op: 'verify_request', ...verifyOp(mineOrigin, mineDirs) }), ...(await verifyBoth('request', verifyOp(mineOrigin, mineDirs))), tier: 'wba' });
+    record('live', `Cloudflare signs ${N}, Python verifies it twice`, refused('nonce-replayed'), {
+      python: await adapter({ op: 'verify_request', ...verifyOp(mine, mineDirs, { prior: [mine] }) }),
+      cloudflare: await judge.verifyRequest(verifyOp(mine, mineDirs, { prior: [mine] })),
+    });
+    const mineUrl = tamperUrl(mine);
+    record('live', `Cloudflare signs ${N}, URL changed, both refuse`, tampered, {
+      python: await adapter({ op: 'verify_request', ...verifyOp(mineUrl, mineDirs) }),
+      ...(await verifyBoth('request', verifyOp(mineUrl, mineDirs))),
+      tier: 'wba',
+    });
+    if (request.body) {
+      const mineBody = tamperBody(mine);
+      record('live', `Cloudflare signs ${N}, body changed, both refuse`, bodyChanged, {
+        python: await adapter({ op: 'verify_request', ...verifyOp(mineBody, mineDirs) }),
+        ...(await verifyBoth('request', verifyOp(mineBody, mineDirs))),
+        tier: 'profile',
+      });
+    }
+  }
+
+  // Target URIs: each side signs a GET to the URL as written, and the other verifies it.
+  for (const c of SCENARIOS.target_uris) {
+    const request = { method: 'GET', url: c.url, headers: {}, body: '' };
+    const id = `${c.id} ${c.name}`;
+    const signed = await adapter({ op: 'sign_request', key, origin, request, now });
+    const whatwg = judge.onTheWire(c.url);
+    const sameUrl = whatwg === c.wire ? { ok: true } : { ok: false, status: null, rule: 'target-uri', error: `${whatwg}, not ${c.wire}` };
+    record('live', `${id}: its wire URL is the WHATWG serialization`, { ok: true }, { cloudflare: sameUrl });
+    record('live', `Python signs ${id}, Cloudflare verifies`, ok, { ...(await verifyBoth('request', verifyOp(signed, { [origin]: theirs }))), tier: 'wba' });
+    const mine = await judge.signRequest({ key, origin, request, now });
+    const mineOp = verifyOp(mine, { [origin]: ours });
+    record('live', `Cloudflare signs ${id}, Python verifies`, ok, { python: await adapter({ op: 'verify_request', ...mineOp }), ...(await verifyBoth('request', mineOp)), tier: 'wba' });
+  }
+
+  // Responses: the seller's key signs, bound to a request the buyer signed.
+  const sellerKey = PRIVATE[RESPONDER.kid];
+  const sellerOk = { ok: true, identity: RESPONDER.identity };
+  const sellerDirs = await signedDirectories({ [RESPONDER.identity]: [RESPONDER.kid] }, now);
+  const request = await judge.signRequest({ key, origin, request: SCENARIOS.requests.post, now });
+  const response = await adapter({ op: 'sign_response', key: sellerKey, origin: RESPONDER.identity, request, response: SCENARIOS.response, now });
+  const op = { request, response, directories: sellerDirs, now, expected_origin: RESPONDER.identity };
+  record('live', 'Python signs a response, Cloudflare verifies it and its binding', sellerOk, { ...(await verifyBoth('response', op)), tier: 'wba' });
+  const otherRequest = await judge.signRequest({ key, origin, request: SCENARIOS.requests.post, now });
+  record('live', 'Python signs a response, presented with another request, both refuse', tampered, {
+    python: await adapter({ op: 'verify_response', ...op, request: otherRequest }),
+    ...(await verifyBoth('response', { ...op, request: otherRequest })),
+    tier: 'wba',
+  });
+  const mineResponse = await judge.signResponse({ key: sellerKey, origin: RESPONDER.identity, request, response: SCENARIOS.response, now });
+  const mineOp = { request, response: mineResponse, directories: sellerDirs, now, expected_origin: RESPONDER.identity };
+  record('live', 'Cloudflare signs a response, Python verifies it and its binding', sellerOk, { python: await adapter({ op: 'verify_response', ...mineOp }), cloudflare: await judge.verifyResponse(mineOp) });
+  const changed = { ...mineResponse, status: 201 };
+  record('live', 'Cloudflare signs a response, status changed, both refuse', tampered, {
+    python: await adapter({ op: 'verify_response', ...mineOp, response: changed }),
+    ...(await verifyBoth('response', { ...mineOp, response: changed })),
+    tier: 'wba',
+  });
+}
+
+// ── Scenarios ─────────────────────────────────────────────────────────────
+
+async function runScenarios(now) {
+  const defaultDirectories = { [SIGNER.identity]: [SIGNER.kid] };
+  for (const s of SCENARIOS.request_scenarios) {
+    const request = await judge.signScenario(SCENARIOS, s, PRIVATE, now);
+    const op = { request, authority: s.authority ?? SCENARIOS.verifier, directories: await signedDirectories(s.directories ?? defaultDirectories, now), now };
+    record('scenarios', `${s.id} ${s.name}`, s.expected, { python: await adapter({ op: 'verify_request', ...op }), ...(await verifyBoth('request', op)), tier: s.tier });
+  }
+  for (const s of SCENARIOS.directory_scenarios) {
+    const { id, name, expected, tier, basis, keys = [SIGNER.kid], ...options } = s;
+    const response = await judge.signDirectory({ ...options, keys: keys.map(k => PRIVATE[k]), origin: SIGNER.identity, now, defaults: DIRECTORY_DEFAULTS });
+    const op = { origin: SIGNER.identity, response, now };
+    record('scenarios', `${id} ${name}`, expected, { python: await adapter({ op: 'verify_directory', ...op }), ...(await verifyBoth('directory', op)), tier });
+  }
+  const sellerDirs = await signedDirectories({ [RESPONDER.identity]: [RESPONDER.kid] }, now);
+  for (const s of SCENARIOS.response_scenarios) {
+    const pair = await judge.signResponseScenario(SCENARIOS, s, PRIVATE, now);
+    const op = { ...pair, directories: sellerDirs, now };
+    record('scenarios', `${s.id} ${s.name}`, s.expected, { python: await adapter({ op: 'verify_response', ...op }), ...(await verifyBoth('response', op)), tier: s.tier });
+  }
+}
+
+// ── Report ────────────────────────────────────────────────────────────────
+
+const now = Math.floor(Date.now() / 1000);
+await runVectors();
+await runLive(now);
+await runScenarios(now);
+persistent?.close();
+
+console.log(`Web Bot Auth interop: ${args.self ? 'judge self-check' : `adapter ${command}`}\n`);
+console.log('ok    suite     tier     python  cloudflare  bare    check');
+for (const c of checks) {
+  console.log(`${c.ok ? 'pass' : 'FAIL'}  ${c.suite.padEnd(9)} ${(c.tier ?? '-').padEnd(8)} ${String(c.python ?? '-').padEnd(7)} ${String(c.cloudflare ?? '-').padEnd(11)} ${String(c.cloudflare_bare ?? '-').padEnd(7)} ${c.id}`);
+  if (!c.ok) console.log(`        expected ${c.expected}\n        python   ${c.detail.python}\n        judge    ${c.detail.cloudflare}\n        bare     ${c.detail.bare}`);
+}
+const failed = checks.filter(c => !c.ok);
+console.log(`\n${checks.length - failed.length} of ${checks.length} checks pass.`);
+if (args.json) writeFileSync(args.json, `${JSON.stringify({ now, checks }, null, 2)}\n`);
+process.exitCode = failed.length === 0 ? 0 : 1;
diff --git a/tests/web_bot_auth/support/__init__.py b/tests/web_bot_auth/support/__init__.py
new file mode 100644
index 0000000..5f7e770
--- /dev/null
+++ b/tests/web_bot_auth/support/__init__.py
@@ -0,0 +1,428 @@
+"""Test support for the Web Bot Auth suite: the keys, the clock, messages, directories, refusals.
+
+The suite's fixed world is the conformance vectors' own: the clock, the
+origins, the seeds, and the bodies come from
+:mod:`~iab_agentic_primitives.web_bot_auth.conformance.fixtures`, so these
+tests and the vectors sign the same messages with the same keys. Messages are
+signed by the real signers; a departure from the profile is a
+:class:`~iab_agentic_primitives.web_bot_auth.conformance.signing.MessageDeparture`,
+signed raw by the conformance interpreter.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import atexit
+import base64
+import hashlib
+import inspect
+import socket
+import threading
+import time
+from collections.abc import Awaitable, Callable, Iterator, Mapping, Sequence
+from contextlib import contextmanager
+from dataclasses import dataclass
+
+import httpx
+import uvicorn
+
+from iab_agentic_primitives.web_bot_auth import (
+    CONFORMANCE_KEYS,
+    Answer,
+    Clock,
+    DirectoryPublisher,
+    DirectoryResolver,
+    Ed25519Key,
+    HTTPRequest,
+    HTTPResponse,
+    KeyId,
+    KeyPolicy,
+    KeyResolver,
+    MemoryNonceStore,
+    NonceStore,
+    Origin,
+    Refusal,
+    RequestConfirmer,
+    RequestSigner,
+    RequestVerifier,
+    ResolvedKey,
+    ResponseSigner,
+    ResponseVerifier,
+    ServerIdentity,
+    UnixSeconds,
+    WebBotAuthError,
+    publish_directory,
+)
+from iab_agentic_primitives.web_bot_auth.asgi import (
+    DEFAULT_SIGNING,
+    ASGIApp,
+    ResponseSigningMiddleware,
+    ServerEdge,
+    SigningPolicy,
+)
+from iab_agentic_primitives.web_bot_auth.conformance.fixtures import (
+    BUYER,
+    COMMIT_BODY,
+    COMMIT_RESULT_BODY,
+    COMMIT_URL,
+    JSON,
+    OTHER,
+    SEED_PREFIX,
+    SELLER,
+    T0,
+    at,
+    key,
+)
+from iab_agentic_primitives.web_bot_auth.conformance.signing import MessageDeparture, RawSigner
+from iab_agentic_primitives.web_bot_auth.testing import directory_transport, served_resolver
+
+BUYER_ORIGIN = Origin.parse(BUYER)
+SELLER_ORIGIN = Origin.parse(SELLER)
+OTHER_ORIGIN = Origin.parse(OTHER)
+#: The seller's own identity, as its middlewares and verifier are configured.
+SELLER_IDENTITY = ServerIdentity.from_config(SELLER)
+
+
+# ── keys ───────────────────────────────────────────────────────────────────
+
+
+def buyer_key() -> Ed25519Key:
+    return key("buyer-request")
+
+
+def other_key() -> Ed25519Key:
+    return key("other-request")
+
+
+def seller_key() -> Ed25519Key:
+    return key("seller-response")
+
+
+def seller_edge(
+    confirmer: RequestConfirmer | None = None, *, identity: ServerIdentity | None = None
+) -> ServerEdge:
+    """The seller's edge: its signer, its directory, and its identity.
+
+    The identity is the confirmer's when one is given, and ``SELLER_IDENTITY`` otherwise.
+    """
+    if identity is None:
+        identity = SELLER_IDENTITY if confirmer is None else confirmer.identity
+    signer = seller_key()
+    return ServerEdge(
+        identity,
+        signer=ResponseSigner.of(signer, identity.origin),
+        publisher=DirectoryPublisher(identity.origin, [signer]),
+        confirmer=confirmer,
+    )
+
+
+def seller_signing(
+    app: ASGIApp,
+    edge: ServerEdge | None = None,
+    *,
+    policy: SigningPolicy = DEFAULT_SIGNING,
+) -> ResponseSigningMiddleware:
+    """``app`` behind the seller's response signing, which serves the directory of its key."""
+    return ResponseSigningMiddleware(app, seller_edge() if edge is None else edge, policy=policy)
+
+
+# ── a live server ──────────────────────────────────────────────────────────
+
+
+def free_port() -> int:
+    """A TCP port on 127.0.0.1 that nothing listens on now."""
+    with socket.socket() as s:
+        s.bind(("127.0.0.1", 0))
+        port: int = s.getsockname()[1]
+        return port
+
+
+@contextmanager
+def serving(app: ASGIApp, port: int) -> Iterator[None]:
+    """Serves ``app`` with uvicorn on 127.0.0.1:``port`` while the block runs."""
+    server = uvicorn.Server(uvicorn.Config(app, host="127.0.0.1", port=port, log_level="error"))
+    thread = threading.Thread(target=server.run, daemon=True)
+    thread.start()
+    deadline = time.monotonic() + 10
+    while not server.started:
+        assert time.monotonic() < deadline, "the server didn't start"
+        time.sleep(0.01)
+    try:
+        yield
+    finally:
+        server.should_exit = True
+        thread.join(timeout=5)
+
+
+# ── digests and messages ───────────────────────────────────────────────────
+
+
+def b64url(data: bytes) -> str:
+    """``data`` as unpadded base64url, as JWKs and nonces carry it."""
+    return base64.urlsafe_b64encode(data).rstrip(b"=").decode()
+
+
+def b64url_bytes(text: str) -> bytes:
+    """The bytes of unpadded or padded base64url ``text``."""
+    return base64.urlsafe_b64decode(text + "=" * (-len(text) % 4))
+
+
+def digest(body: bytes) -> str:
+    """The ``Content-Digest`` of ``body`` with its ``sha-256`` member (RFC 9530)."""
+    return f"sha-256=:{base64.b64encode(hashlib.sha256(body).digest()).decode()}:"
+
+
+def digest_without_sha256(body: bytes) -> str:
+    """A correct ``Content-Digest`` of ``body`` that carries only ``sha-512``."""
+    return f"sha-512=:{base64.b64encode(hashlib.sha512(body).digest()).decode()}:"
+
+
+def commit(body: bytes = COMMIT_BODY) -> HTTPRequest:
+    """The unsigned commit request."""
+    return HTTPRequest("POST", COMMIT_URL, JSON, body)
+
+
+def sign_request(
+    request: HTTPRequest | None = None,
+    signer: RequestSigner | None = None,
+    *,
+    now: UnixSeconds = T0,
+    departure: MessageDeparture | None = None,
+) -> HTTPRequest:
+    """``request`` (the commit by default) signed by ``signer`` (the buyer by default).
+
+    With a ``departure``, it is signed raw, as ``signer`` would but departing.
+    """
+    signer = RequestSigner.of(buyer_key(), BUYER) if signer is None else signer
+    request = commit() if request is None else request
+    if departure is None:
+        return signer.sign(request, now=now)
+    return RawSigner(signer.config, departure).request(request, now)
+
+
+def sign_response(
+    request: HTTPRequest,
+    signer: ResponseSigner | None = None,
+    *,
+    now: UnixSeconds = T0,
+    departure: MessageDeparture | None = None,
+) -> HTTPResponse:
+    """The seller's CommitResult to ``request``, signed by ``signer`` (the seller by default).
+
+    With a ``departure``, it is signed raw, as ``signer`` would but departing.
+    """
+    signer = ResponseSigner.of(seller_key(), SELLER) if signer is None else signer
+    response = HTTPResponse(200, JSON, COMMIT_RESULT_BODY, request)
+    if departure is None:
+        return signer.sign(response, now=now)
+    return RawSigner(signer.config, departure).response(response, now)
+
+
+# ── directories and verifiers ──────────────────────────────────────────────
+
+
+def origin_of(origin: Origin | str) -> Origin:
+    """``origin`` as an :class:`Origin`; a string is read with :meth:`Origin.parse`."""
+    return origin if isinstance(origin, Origin) else Origin.parse(origin)
+
+
+def signed_directory(
+    origin: Origin | str, keys: Sequence[Ed25519Key], now: UnixSeconds = T0
+) -> Answer:
+    """The directory of ``origin``, published with ``keys`` and signed at ``now``."""
+    return publish_directory(origin_of(origin), keys, now=now)
+
+
+def directory_transport_for(
+    directories: Mapping[str, Sequence[Ed25519Key]], now: UnixSeconds = T0
+) -> httpx.MockTransport:
+    """A transport that serves each origin's signed directory, signed at ``now``."""
+    served = {
+        origin_of(origin): signed_directory(origin, keys, now)
+        for origin, keys in directories.items()
+    }
+    return directory_transport(served)
+
+
+def directory_resolver(
+    directories: Mapping[str, Sequence[Ed25519Key]], *, now: UnixSeconds | None = None
+) -> DirectoryResolver:
+    """A resolver over signed directories served from data, signed and fetched at ``now``.
+
+    ``now`` is ``T0`` by default.
+    """
+    at = T0 if now is None else now
+    return served_resolver(
+        {origin_of(o): signed_directory(o, keys, at) for o, keys in directories.items()},
+        clock=lambda: at,
+    )
+
+
+@dataclass(frozen=True, slots=True)
+class Clocked:
+    """A resolver and the clock its resolves read, as a verifier passes ``now``."""
+
+    resolver: KeyResolver
+    clock: Clock
+
+    async def resolve(self, origin: Origin, keyid: KeyId) -> ResolvedKey:
+        return await self.resolver.resolve(origin, keyid, now=self.clock())
+
+
+def request_verifier(
+    *,
+    resolver: KeyResolver | None = None,
+    now: UnixSeconds = T0,
+    nonces: NonceStore | None = None,
+    identity: ServerIdentity = SELLER_IDENTITY,
+    keys: KeyPolicy = CONFORMANCE_KEYS,
+) -> RequestVerifier:
+    """The suite's one request verifier: the seller's, with its clock at ``now``.
+
+    By default it resolves the buyer's and the other origin's directories and
+    records nonces in memory on the same clock.
+    """
+    if resolver is None:
+        resolver = directory_resolver({BUYER: [buyer_key()], OTHER: [other_key()]}, now=now)
+    return RequestVerifier(
+        resolver,
+        identity=identity,
+        nonces=MemoryNonceStore(clock=lambda: now) if nonces is None else nonces,
+        clock=lambda: now,
+        keys=keys,
+    )
+
+
+def response_verifier(
+    *, resolver: KeyResolver | None = None, now: UnixSeconds = T0
+) -> ResponseVerifier:
+    """The suite's one response verifier: the buyer's, over the seller's directory by default."""
+    if resolver is None:
+        resolver = directory_resolver({SELLER: [seller_key()]}, now=now)
+    return ResponseVerifier(resolver, clock=lambda: now, keys=CONFORMANCE_KEYS)
+
+
+# ── calls and refusals ─────────────────────────────────────────────────────
+
+
+#: The suite's one event loop: a resolver belongs to the loop it first resolves on, and
+#: a test that resolves more than once runs as one program does, on one loop.
+_RUNNER = asyncio.Runner()
+atexit.register(_RUNNER.close)
+
+
+def run[T](coroutine: Awaitable[T]) -> T:
+    """Runs ``coroutine`` to completion on the suite's one event loop."""
+
+    async def wait() -> T:
+        return await coroutine
+
+    return _RUNNER.run(wait())
+
+
+def expect_refusal(call: Callable[[], object], refusal: Refusal) -> WebBotAuthError:
+    """Calls ``call`` (awaiting what it returns, if it's awaitable) and asserts ``refusal``.
+
+    Returns the :class:`WebBotAuthError`, whose ``status`` is the refusal's.
+    """
+    try:
+        result = call()
+        if inspect.isawaitable(result):
+            run(result)
+    except WebBotAuthError as e:
+        assert e.refusal is refusal, f"refused with {e.refusal}, not {refusal}: {e}"
+        assert e.status == refusal.status
+        return e
+    raise AssertionError(f"accepted; expected the refusal {refusal}")
+
+
+# The crafting helpers are part of the one support namespace; they import from above.
+# isort: split
+from .crafting import (  # noqa: E402
+    BODY_COMPONENTS,
+    GET_COMPONENTS,
+    POSITIVE_001,
+    POSITIVE_003,
+    POST_COMPONENTS,
+    CraftOptions,
+    SignOptions,
+    added_lines,
+    craft,
+    edited,
+    fetched,
+    fetched_from,
+    get_components,
+    inner_list,
+    post_components,
+    request_added,
+    response_added,
+    signed_commit,
+    signed_result,
+    spec,
+    vector_message,
+    vector_request,
+    verify,
+)
+
+__all__ = [
+    "BODY_COMPONENTS",
+    "BUYER",
+    "BUYER_ORIGIN",
+    "COMMIT_BODY",
+    "COMMIT_RESULT_BODY",
+    "COMMIT_URL",
+    "GET_COMPONENTS",
+    "JSON",
+    "OTHER",
+    "OTHER_ORIGIN",
+    "POSITIVE_001",
+    "POSITIVE_003",
+    "POST_COMPONENTS",
+    "SEED_PREFIX",
+    "SELLER",
+    "SELLER_IDENTITY",
+    "SELLER_ORIGIN",
+    "T0",
+    "Clocked",
+    "CraftOptions",
+    "SignOptions",
+    "UnixSeconds",
+    "added_lines",
+    "at",
+    "b64url",
+    "b64url_bytes",
+    "buyer_key",
+    "commit",
+    "craft",
+    "digest",
+    "digest_without_sha256",
+    "directory_resolver",
+    "directory_transport_for",
+    "edited",
+    "expect_refusal",
+    "fetched",
+    "fetched_from",
+    "get_components",
+    "inner_list",
+    "key",
+    "origin_of",
+    "other_key",
+    "post_components",
+    "request_added",
+    "request_verifier",
+    "response_added",
+    "response_verifier",
+    "run",
+    "seller_edge",
+    "seller_key",
+    "seller_signing",
+    "sign_request",
+    "sign_response",
+    "signed_commit",
+    "signed_directory",
+    "signed_result",
+    "spec",
+    "vector_message",
+    "vector_request",
+    "verify",
+]
diff --git a/tests/web_bot_auth/support/crafting.py b/tests/web_bot_auth/support/crafting.py
new file mode 100644
index 0000000..0dd6d63
--- /dev/null
+++ b/tests/web_bot_auth/support/crafting.py
@@ -0,0 +1,289 @@
+"""Requests and documents the tests craft, each signed by the real signers.
+
+:func:`craft` signs a request with any components and parameters, including
+ones the profile refuses, raw, through the conformance interpreter. The rest give
+the field lines a signer adds, the components the rules require in the
+``scenarios.json`` spelling, and :func:`edited`, the one way a test tampers
+with a signed request.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Iterable, Mapping
+from dataclasses import replace
+from typing import TypedDict, Unpack
+
+import httpx
+
+from iab_agentic_primitives.web_bot_auth import (
+    DIRECTORY_PATH,
+    DirectoryResponse,
+    Ed25519Key,
+    HeaderLines,
+    Headers,
+    HTTPRequest,
+    HTTPResponse,
+    Origin,
+    RequestSigner,
+    RequestVerifier,
+    ResponseSigner,
+    UnixSeconds,
+    VerifiedRequest,
+)
+from iab_agentic_primitives.web_bot_auth.conformance import vectors
+from iab_agentic_primitives.web_bot_auth.conformance.models import (
+    DirectoryDoc,
+    RequestDoc,
+    ResponseDoc,
+    SignatureParameters,
+    Vector,
+    VerifyDirectory,
+    VerifyRequest,
+)
+from iab_agentic_primitives.web_bot_auth.conformance.signing import (
+    MessageDeparture,
+    RawSigner,
+    components_of,
+)
+from iab_agentic_primitives.web_bot_auth.rules import REQUEST, ComponentId
+from iab_agentic_primitives.web_bot_auth.signer import SignerConfig
+
+from . import (
+    BUYER,
+    COMMIT_BODY,
+    COMMIT_RESULT_BODY,
+    COMMIT_URL,
+    JSON,
+    SELLER,
+    T0,
+    run,
+)
+
+
+def edited(
+    request: HTTPRequest,
+    *,
+    headers: Mapping[str, str | None] | None = None,
+    body: bytes | None = None,
+    url: str | None = None,
+) -> HTTPRequest:
+    """``request`` tampered with after signing: the one way a test changes a signed message.
+
+    Each field in ``headers`` keeps its place with the new value, or goes when
+    the value is ``None``; a field the request lacks is added at the end.
+    ``body`` and ``url`` replace the request's own.
+    """
+    changes = {name.lower(): value for name, value in (headers or {}).items()}
+    lines: list[tuple[str, str]] = []
+    for name, value in request.headers:
+        new = changes.pop(name.lower(), value)
+        if new is not None:
+            lines.append((name, new))
+    lines.extend(
+        (name, value)
+        for name, value in (headers or {}).items()
+        if name.lower() in changes and value is not None
+    )
+    return replace(
+        request,
+        headers=HeaderLines(lines),
+        body=request.body if body is None else body,
+        url=request.url if url is None else url,
+    )
+
+
+def spec(component: ComponentId) -> str:
+    """The ``scenarios.json`` spelling of ``component``, such as ``signature-agent;key=sig1``."""
+    params = "".join(f";{k}" if v is True else f";{k}={v}" for k, v in component.params)
+    return component.name + params
+
+
+def inner_list(components: Iterable[ComponentId]) -> str:
+    """The serialized Inner List of ``components``, as ``Signature-Input`` carries it."""
+    return "(" + " ".join(str(c) for c in components) + ")"
+
+
+def post_components(label: str = "sig1") -> list[str]:
+    """The components a request with a body covers, from the rules."""
+    return [spec(c) for c in REQUEST.components(label, has_body=True)]
+
+
+def get_components(label: str = "sig1") -> list[str]:
+    """The components a request without a body covers, from the rules."""
+    return [spec(c) for c in REQUEST.components(label, has_body=False)]
+
+
+#: The components a body adds to a request signature.
+BODY_COMPONENTS = tuple(
+    c
+    for c in REQUEST.components("sig1", has_body=True)
+    if c not in REQUEST.components("sig1", has_body=False)
+)
+#: The rules' request components, with ``{label}`` for the signature label.
+POST_COMPONENTS = post_components("{label}")
+GET_COMPONENTS = get_components("{label}")
+
+
+def vector_request(vector: Vector) -> RequestDoc:
+    """The request a request or response vector's operation sends."""
+    operation = vector.operation
+    if isinstance(operation, VerifyDirectory):
+        raise TypeError(f"{vector.name} sends a directory, not a request")
+    return operation.request
+
+
+def vector_message(vector: Vector) -> RequestDoc | ResponseDoc | DirectoryDoc:
+    """The message a vector's operation is graded on: its response, or else its request."""
+    operation = vector.operation
+    return operation.request if isinstance(operation, VerifyRequest) else operation.response
+
+
+_VECTORS = dict(vectors())
+#: The signed commit request of the committed positive vector 001.
+POSITIVE_001 = vector_request(_VECTORS["positive/001-single-signer-request"])
+#: The seller's response of the committed positive vector 003, bound to 001's request.
+POSITIVE_003 = vector_message(_VECTORS["positive/003-signed-response"])
+
+
+class CraftOptions(TypedDict, total=False):
+    """What :func:`craft` changes from the signed commit."""
+
+    method: str
+    url: str
+    body: bytes
+    headers: Mapping[str, str]
+    agent: str
+    label: str
+    components: list[str]
+    params: SignatureParameters
+    now: UnixSeconds
+
+
+def craft(key: Ed25519Key, **options: Unpack[CraftOptions]) -> HTTPRequest:
+    """Signs a request with any components and parameters, including ones the profile refuses.
+
+    ``params`` moves the signature's parameters (offsets for ``created`` and
+    ``expires``; ``None`` omits one). ``agent`` is the ``Signature-Agent``
+    value. It is signed raw, as the buyer's signer would but departing.
+    """
+    body = options.get("body", COMMIT_BODY)
+    label = options.get("label", "sig1")
+    defaults = POST_COMPONENTS if body else GET_COMPONENTS
+    departure = MessageDeparture(
+        components=components_of(options.get("components") or defaults, label),
+        parameters=options.get("params", SignatureParameters()),
+        signature_agent=options.get("agent"),
+    )
+    headers = options.get("headers", JSON if body else {})
+    request = HTTPRequest(
+        options.get("method", "POST"), options.get("url", COMMIT_URL), headers, body
+    )
+    config = SignerConfig(key, Origin.parse(BUYER), label=label)
+    return RawSigner(config, departure).request(request, options.get("now", T0))
+
+
+def signed_commit(
+    key: Ed25519Key, origin: str = BUYER, *, now: UnixSeconds = T0, body: bytes = COMMIT_BODY
+) -> HTTPRequest:
+    """The commit request, signed."""
+    return RequestSigner.of(key, origin).sign(HTTPRequest("POST", COMMIT_URL, JSON, body), now=now)
+
+
+def signed_result(
+    key: Ed25519Key, request: HTTPRequest, *, now: UnixSeconds = T0, status: int = 200
+) -> tuple[HTTPRequest, HeaderLines]:
+    """The seller's signed CommitResult to ``request``: the request and the response headers."""
+    response = HTTPResponse(status, JSON, COMMIT_RESULT_BODY, request)
+    return request, ResponseSigner.of(key, SELLER).sign(response, now=now).headers
+
+
+def added_lines(before: HeaderLines, after: HeaderLines) -> dict[str, str]:
+    """The field lines signing appended to ``before``."""
+    assert after.items()[: len(before)] == before.items()
+    return dict(after.items()[len(before) :])
+
+
+class SignOptions(TypedDict, total=False):
+    """The signing options :func:`request_added` and :func:`response_added` pass on."""
+
+    now: UnixSeconds
+    nonce: str
+
+
+def request_added(
+    signer: RequestSigner,
+    method: str,
+    url: str,
+    headers: Mapping[str, str] | None = None,
+    body: bytes = b"",
+    **sign: Unpack[SignOptions],
+) -> dict[str, str]:
+    """The field lines ``signer`` adds to the request."""
+    request = HTTPRequest(method, url, headers or {}, body)
+    signed = signer.sign(request, now=sign.get("now"), nonce=sign.get("nonce"))
+    return added_lines(request.headers, signed.headers)
+
+
+def response_added(
+    signer: ResponseSigner,
+    status: int,
+    headers: Mapping[str, str] | None,
+    body: bytes,
+    request: HTTPRequest,
+    **sign: Unpack[SignOptions],
+) -> dict[str, str]:
+    """The field lines ``signer`` adds to the response."""
+    response = HTTPResponse(status, headers or {}, body, request)
+    return added_lines(response.headers, signer.sign(response, now=sign.get("now")).headers)
+
+
+def fetched_from(response: httpx.Response, now: UnixSeconds) -> DirectoryResponse:
+    """An ``httpx.Response`` from a directory route, as a fetcher returns it."""
+    lines = response.headers.multi_items()
+    return DirectoryResponse(str(response.url), response.status_code, lines, response.content, now)
+
+
+def verify(
+    verifier: RequestVerifier, request: HTTPRequest, *, now: UnixSeconds | None = None
+) -> VerifiedRequest:
+    """Verifies ``request``, at ``now`` when given."""
+    return run(verifier.verify(request, now=now))
+
+
+def fetched(
+    status: int,
+    headers: Headers,
+    body: bytes,
+    *,
+    origin: Origin | str = BUYER,
+    now: UnixSeconds = T0,
+) -> DirectoryResponse:
+    """The directory response ``(status, headers, body)`` as fetched from ``origin`` at ``now``."""
+    return DirectoryResponse(f"{origin}{DIRECTORY_PATH}", status, headers, body, now)
+
+
+__all__ = [
+    "BODY_COMPONENTS",
+    "GET_COMPONENTS",
+    "POSITIVE_001",
+    "POSITIVE_003",
+    "POST_COMPONENTS",
+    "CraftOptions",
+    "SignOptions",
+    "added_lines",
+    "craft",
+    "edited",
+    "fetched",
+    "fetched_from",
+    "get_components",
+    "inner_list",
+    "post_components",
+    "request_added",
+    "response_added",
+    "signed_commit",
+    "signed_result",
+    "spec",
+    "vector_message",
+    "vector_request",
+    "verify",
+]
diff --git a/tests/web_bot_auth/test_wba_asgi.py b/tests/web_bot_auth/test_wba_asgi.py
new file mode 100644
index 0000000..77170ee
--- /dev/null
+++ b/tests/web_bot_auth/test_wba_asgi.py
@@ -0,0 +1,453 @@
+"""The ASGI edges, driven as an ASGI server drives them: pathsend, the body cap, optional mode."""
+
+from __future__ import annotations
+
+import json
+from collections.abc import Iterable, Mapping
+from pathlib import Path
+
+import httpx
+import pytest
+from fastapi import FastAPI, Request
+from starlette.responses import FileResponse
+
+from iab_agentic_primitives.web_bot_auth import (
+    CONFORMANCE_KEYS,
+    DIRECTORY_PATH,
+    DirectoryPublisher,
+    DirectoryResolver,
+    Ed25519Key,
+    HTTPRequest,
+    MemoryNonceStore,
+    NonceStoreUnavailable,
+    Origin,
+    RequestSigner,
+    RequestVerifier,
+    Seconds,
+    StaticKeyResolver,
+    VerifiedRequest,
+    accept_signature,
+    system_clock,
+)
+from iab_agentic_primitives.web_bot_auth.asgi import (
+    MAX_BODY_BYTES,
+    STATE_KEY,
+    ASGIApp,
+    DirectoryMiddleware,
+    Message,
+    OnUnsigned,
+    Receive,
+    RequirePolicy,
+    RequireSignatureMiddleware,
+    ResponseSigningMiddleware,
+    Scope,
+    Send,
+    SigningPolicy,
+    verified_request,
+)
+from iab_agentic_primitives.web_bot_auth.fetcher import HttpxDirectoryFetcher
+from iab_agentic_primitives.web_bot_auth.httpx import EXTENSION, verified_response
+
+from . import support as w
+
+SELLER_URL = "https://seller.example.com"
+
+
+def _scope(
+    path: str,
+    *,
+    method: str = "GET",
+    headers: Iterable[tuple[str, str]] = (),
+    extensions: Mapping[str, object] | None = None,
+) -> dict[str, object]:
+    return {
+        "type": "http",
+        "asgi": {"version": "3.0"},
+        "http_version": "1.1",
+        "method": method,
+        "scheme": "https",
+        "path": path,
+        "raw_path": path.encode(),
+        "query_string": b"",
+        "root_path": "",
+        "headers": [(k.lower().encode(), v.encode()) for k, v in headers],
+        "server": ("seller.example.com", 443),
+        "extensions": extensions or {},
+    }
+
+
+async def _drive(app: ASGIApp, scope: Scope, receive: Receive) -> list[Message]:
+    sent: list[Message] = []
+
+    async def send(message: Message) -> None:
+        sent.append(message)
+
+    await app(scope, receive, send)
+    return sent
+
+
+def _start(sent: list[Message]) -> tuple[int, dict[str, str]]:
+    start = sent[0]
+    assert start["type"] == "http.response.start"
+    status, lines = start["status"], start["headers"]
+    assert isinstance(status, int) and isinstance(lines, list)
+    return status, {k.decode(): v.decode() for k, v in lines}
+
+
+def _body(message: Message) -> bytes:
+    body = message["body"]
+    assert isinstance(body, bytes)
+    return body
+
+
+# ── pathsend ──────────────────────────────────────────────────────────────
+
+
+def test_a_file_response_under_pathsend_is_sent_as_a_signed_body(tmp_path: Path) -> None:
+    report = tmp_path / "report.json"
+    report.write_bytes(b'{"ok": true}')
+    api = FastAPI()
+
+    @api.get("/report")
+    async def get_report() -> FileResponse:
+        return FileResponse(report, media_type="application/json")
+
+    app = w.seller_signing(api)
+    scope = _scope("/report", extensions={"http.response.pathsend": {}})
+
+    async def receive() -> Message:
+        return {"type": "http.request", "body": b"", "more_body": False}
+
+    sent = w.run(_drive(app, scope, receive))
+    status, headers = _start(sent)
+    assert status == 200 and "signature" in headers and "signature-input" in headers
+    assert [m["type"] for m in sent] == ["http.response.start", "http.response.body"]
+    assert sent[1]["body"] == b'{"ok": true}'
+
+
+def test_an_unexpected_message_after_the_start_is_unsignable() -> None:
+    async def app(scope: Scope, receive: Receive, send: Send) -> None:
+        await send({"type": "http.response.start", "status": 200, "headers": []})
+        await send({"type": "http.response.zerocopy", "file": 3})
+
+    signing = w.seller_signing(app)
+
+    async def receive() -> Message:
+        return {"type": "http.request", "body": b""}
+
+    sent = w.run(_drive(signing, _scope("/x"), receive))
+    status, _ = _start(sent)
+    assert status == 500 and json.loads(_body(sent[1]))["error"] == "response-unsignable"
+
+
+# ── the body cap and the header check ────────────────────────────────────
+
+
+def _guarded(
+    on_unsigned: OnUnsigned = "refuse", max_body_bytes: int = 1024 * 1024
+) -> tuple[RequireSignatureMiddleware, list[VerifiedRequest | None]]:
+    seen: list[VerifiedRequest | None] = []
+    api = FastAPI()
+
+    @api.post("/proposals/commit")
+    async def commit(request: Request) -> dict[str, bool]:
+        seen.append(verified_request(request.scope))
+        await request.body()
+        return {"ok": True}
+
+    verifier = RequestVerifier(
+        StaticKeyResolver({w.BUYER: [w.buyer_key()]}),
+        identity=w.SELLER_IDENTITY,
+        nonces=MemoryNonceStore(),
+        keys=CONFORMANCE_KEYS,
+    )
+    app = RequireSignatureMiddleware(
+        api,
+        w.seller_edge(verifier),
+        policy=RequirePolicy(on_unsigned=on_unsigned, max_body_bytes=max_body_bytes),
+    )
+    return app, seen
+
+
+def test_an_unsigned_10_mb_post_is_refused_before_its_body_is_read() -> None:
+    app, seen = _guarded()
+    reads: list[int] = []
+
+    async def receive() -> Message:
+        reads.append(1)
+        raise AssertionError("the body was read")
+
+    size = 10 * 1024 * 1024
+    scope = _scope(
+        "/proposals/commit",
+        method="POST",
+        headers=[("content-type", "application/json"), ("content-length", str(size))],
+    )
+    sent = w.run(_drive(app, scope, receive))
+    status, headers = _start(sent)
+    assert status == 403 and json.loads(_body(sent[1]))["error"] == "signature-missing"
+    assert headers["accept-signature"] == accept_signature(has_body=True)
+    assert reads == [] and seen == []
+
+
+def _signed(body: bytes = b'{"entry": 1}') -> HTTPRequest:
+    request = HTTPRequest("POST", SELLER_URL + "/proposals/commit", w.JSON, body)
+    return RequestSigner.of(w.buyer_key(), w.BUYER).sign(request, now=system_clock())
+
+
+def _post(app: ASGIApp, request: HTTPRequest) -> httpx.Response:
+    async def send() -> httpx.Response:
+        transport = httpx.ASGITransport(app=app)
+        async with httpx.AsyncClient(transport=transport) as client:
+            return await client.post(
+                request.url, headers=list(request.headers.items()), content=request.body
+            )
+
+    return w.run(send())
+
+
+def test_a_signed_body_over_the_limit_is_413() -> None:
+    app, seen = _guarded(max_body_bytes=8)
+    response = _post(app, _signed(b'{"entry": 12345}'))
+    assert response.status_code == 413 and response.json()["error"] == "body-too-large"
+    assert seen == []
+
+
+class _DownStore:
+    async def check_and_record(self, origin: Origin, nonce: str, ttl: Seconds) -> bool:
+        raise NonceStoreUnavailable("redis at 10.0.0.5:6379 refused the connection")
+
+
+def _unreachable(request: httpx.Request) -> httpx.Response:
+    raise httpx.ConnectError("[Errno 8] nodename nor servname known: billing.corp.internal")
+
+
+def test_a_refusal_body_carries_the_reason_and_status_and_no_detail() -> None:
+    # A peer signs with a key of its own, naming a host the verifier can't reach.
+    resolver = DirectoryResolver(HttpxDirectoryFetcher(transport=httpx.MockTransport(_unreachable)))
+    verifier = RequestVerifier(resolver, identity=w.SELLER_IDENTITY, nonces=MemoryNonceStore())
+    app = RequireSignatureMiddleware(_not_found, w.seller_edge(verifier))
+    probe = RequestSigner.of(Ed25519Key.generate(), "https://billing.corp.internal")
+    request = HTTPRequest("POST", SELLER_URL + "/proposals/commit", w.JSON, b'{"entry": 1}')
+    response = _post(app, probe.sign(request))
+    assert response.status_code == 403
+    assert response.json() == {"error": "directory-unavailable", "status": 403}
+
+
+def test_a_nonce_store_failure_is_answered_without_the_stores_message() -> None:
+    verifier = RequestVerifier(
+        StaticKeyResolver({w.BUYER: [w.buyer_key()]}),
+        identity=w.SELLER_IDENTITY,
+        nonces=_DownStore(),
+        keys=CONFORMANCE_KEYS,
+    )
+    app = RequireSignatureMiddleware(_not_found, w.seller_edge(verifier))
+    response = _post(app, _signed())
+    assert response.status_code == 503
+    assert response.json() == {"error": "nonce-store-unavailable", "status": 503}
+
+
+@pytest.mark.parametrize("on_unsigned", ["refuse", "pass"])
+def test_a_forged_signature_is_refused_in_either_mode(on_unsigned: OnUnsigned) -> None:
+    app, seen = _guarded(on_unsigned)
+    forged = _signed()
+    forged = HTTPRequest(forged.method, forged.url, forged.headers, b'{"entry": 2}')
+    response = _post(app, forged)
+    assert response.status_code == 403 and response.json()["error"] == "content-digest"
+    assert seen == []
+
+
+def test_optional_mode_verifies_a_signed_request_and_hands_over_the_credential() -> None:
+    app, seen = _guarded("pass")
+    assert _post(app, _signed()).status_code == 200
+    assert len(seen) == 1
+    credential = seen[0]
+    assert credential is not None and str(credential.origin) == w.BUYER
+
+
+def test_optional_mode_passes_an_unsigned_request_unread() -> None:
+    app, seen = _guarded("pass")
+    unsigned = HTTPRequest("POST", SELLER_URL + "/proposals/commit", w.JSON, b"{}")
+    assert _post(app, unsigned).status_code == 200
+    assert seen == [None]
+
+
+#: Signature fields of no web-bot-auth signature: another scheme's, and a lone Signature.
+NOT_SIGNED_UNDER_THE_PROFILE = [
+    ("Signature", 'keyId="k",algorithm="hs2019",headers="date",signature="abc"'),
+    ("Signature", "sig1=:AAAA:"),
+]
+
+
+@pytest.mark.parametrize("line", NOT_SIGNED_UNDER_THE_PROFILE, ids=["cavage", "signature-alone"])
+def test_a_message_without_signature_input_is_unsigned(line: tuple[str, str]) -> None:
+    # Optional mode passes it on unsigned; required mode asks it for a signature.
+    request = HTTPRequest("POST", SELLER_URL + "/proposals/commit", [*w.JSON.items(), line], b"{}")
+    app, seen = _guarded("pass")
+    assert _post(app, request).status_code == 200 and seen == [None]
+    app, seen = _guarded("refuse")
+    refused = _post(app, request)
+    assert refused.status_code == 403 and refused.json()["error"] == "signature-missing"
+    assert refused.headers["accept-signature"] == accept_signature(has_body=True)
+    assert seen == []
+
+
+def test_on_unsigned_takes_refuse_or_pass() -> None:
+    from iab_agentic_primitives.web_bot_auth import ConfigurationError
+
+    with pytest.raises(ConfigurationError):
+        _guarded("maybe")  # type: ignore[arg-type]
+
+
+def _signed_scope(request: HTTPRequest, *, declare_length: bool) -> dict[str, object]:
+    lines = [(k, v) for k, v in request.headers.items() if k.lower() != "content-length"]
+    if declare_length:
+        lines.append(("content-length", str(len(request.body))))
+    return _scope("/proposals/commit", method="POST", headers=lines)
+
+
+def test_a_declared_length_over_the_limit_is_413_before_any_read() -> None:
+    app, seen = _guarded(max_body_bytes=8)
+    reads: list[int] = []
+
+    async def receive() -> Message:
+        reads.append(1)
+        raise AssertionError("the body was read")
+
+    request = _signed(b'{"entry": 12345}')
+    sent = w.run(_drive(app, _signed_scope(request, declare_length=True), receive))
+    assert _start(sent)[0] == 413 and reads == [] and seen == []
+
+
+def test_a_streamed_body_stops_being_read_past_the_limit() -> None:
+    app, seen = _guarded(max_body_bytes=8)
+    chunks = [b'{"entry"', b": 12345", b"}"]
+    reads: list[int] = []
+
+    async def receive() -> Message:
+        reads.append(1)
+        return {"type": "http.request", "body": chunks.pop(0), "more_body": bool(chunks)}
+
+    request = _signed(b'{"entry": 12345}')
+    sent = w.run(_drive(app, _signed_scope(request, declare_length=False), receive))
+    assert _start(sent)[0] == 413 and len(reads) == 2 and seen == []
+
+
+# ── the answer serializer and the buffered response ──────────────────────
+
+
+async def _no_body() -> Message:
+    return {"type": "http.request", "body": b"", "more_body": False}
+
+
+def _directory_app() -> DirectoryMiddleware:
+    return DirectoryMiddleware(
+        _not_found, DirectoryPublisher(w.SELLER_ORIGIN, [w.seller_key()]), clock=lambda: w.T0
+    )
+
+
+async def _not_found(scope: Scope, receive: Receive, send: Send) -> None:
+    await send({"type": "http.response.start", "status": 404, "headers": []})
+    await send({"type": "http.response.body", "body": b""})
+
+
+def test_head_on_the_directory_sends_the_get_headers_and_no_body() -> None:
+    app = _directory_app()
+    get = w.run(_drive(app, _scope(DIRECTORY_PATH), _no_body))
+    head = w.run(_drive(app, _scope(DIRECTORY_PATH, method="HEAD"), _no_body))
+    assert _start(head) == _start(get)
+    assert int(_start(get)[1]["content-length"]) == len(_body(get[1])) > 0
+    assert _body(head[1]) == b""
+
+
+def _signing(app: ASGIApp, max_body_bytes: int = MAX_BODY_BYTES) -> ResponseSigningMiddleware:
+    return w.seller_signing(app, policy=SigningPolicy(max_body_bytes=max_body_bytes))
+
+
+def test_a_second_start_answers_500() -> None:
+    async def app(scope: Scope, receive: Receive, send: Send) -> None:
+        await send({"type": "http.response.start", "status": 200, "headers": []})
+        await send({"type": "http.response.start", "status": 201, "headers": []})
+        await send({"type": "http.response.body", "body": b"{}"})
+
+    sent = w.run(_drive(_signing(app), _scope("/x"), _no_body))
+    assert _start(sent)[0] == 500
+    assert json.loads(_body(sent[1]))["error"] == "response-unsignable"
+    assert len(sent) == 2
+
+
+def _json_app(chunks: list[bytes], declared: int | None = None) -> ASGIApp:
+    headers = [(b"content-type", b"application/json")]
+    if declared is not None:
+        headers.append((b"content-length", str(declared).encode()))
+
+    async def app(scope: Scope, receive: Receive, send: Send) -> None:
+        await send({"type": "http.response.start", "status": 200, "headers": headers})
+        for i, chunk in enumerate(chunks):
+            more = i < len(chunks) - 1
+            await send({"type": "http.response.body", "body": chunk, "more_body": more})
+
+    return app
+
+
+def test_a_response_body_over_the_cap_answers_500(tmp_path: Path) -> None:
+    # Streamed past the cap, declared past it, and a file past it.
+    big = tmp_path / "big.json"
+    big.write_bytes(b"[" + b"0," * 600 + b"0]")
+    files = FastAPI()
+
+    @files.get("/big")
+    async def get_big() -> FileResponse:
+        return FileResponse(big, media_type="application/json")
+
+    apps: list[tuple[ASGIApp, str]] = [
+        (_json_app([b"[" + b"0," * 300, b"0" * 400 + b"]"]), "/x"),
+        (_json_app([b"[]"], declared=2048), "/x"),
+        (files, "/big"),
+    ]
+    for app, path in apps:
+        sent = w.run(_drive(_signing(app, max_body_bytes=1000), _scope(path), _no_body))
+        assert _start(sent)[0] == 500, path
+        assert json.loads(_body(sent[1]))["error"] == "response-unsignable"
+    within = w.run(
+        _drive(_signing(_json_app([b"[1]"]), max_body_bytes=1000), _scope("/x"), _no_body)
+    )
+    assert _start(within)[0] == 200 and "signature" in _start(within)[1]
+
+
+def test_the_directory_is_fetched_unsigned_when_signatures_are_required_outside_it() -> None:
+    verifier = RequestVerifier(
+        StaticKeyResolver({}),
+        identity=w.SELLER_IDENTITY,
+        nonces=MemoryNonceStore(),
+        keys=CONFORMANCE_KEYS,
+    )
+    app = RequireSignatureMiddleware(_directory_app(), w.seller_edge(verifier))
+    sent = w.run(_drive(app, _scope(DIRECTORY_PATH), _no_body))
+    assert _start(sent)[0] == 200 and "signature" in _start(sent)[1]
+    refused = w.run(_drive(app, _scope("/proposals"), _no_body))
+    assert _start(refused)[0] == 403
+
+
+def test_an_unsigned_get_is_asked_for_the_components_of_a_request_without_a_body() -> None:
+    verifier = RequestVerifier(
+        StaticKeyResolver({}),
+        identity=w.SELLER_IDENTITY,
+        nonces=MemoryNonceStore(),
+        keys=CONFORMANCE_KEYS,
+    )
+    app = RequireSignatureMiddleware(_not_found, w.seller_edge(verifier))
+    sent = w.run(_drive(app, _scope("/proposals/prop_7"), _no_body))
+    status, headers = _start(sent)
+    assert status == 403
+    assert headers["accept-signature"] == accept_signature(has_body=False)
+
+
+def test_each_accessor_reads_only_its_own_credential() -> None:
+    request = w.run(w.request_verifier().verify(w.sign_request()))
+    response_verifier = w.response_verifier()
+    response = w.run(response_verifier.verify(w.sign_response(w.sign_request())))
+    assert verified_request({"state": {STATE_KEY: response}}) is None
+    assert verified_request({"state": {STATE_KEY: request}}) is request
+    assert verified_response(httpx.Response(200, extensions={EXTENSION: request})) is None
+    assert verified_response(httpx.Response(200, extensions={EXTENSION: response})) is response
diff --git a/tests/web_bot_auth/test_wba_client_answers.py b/tests/web_bot_auth/test_wba_client_answers.py
new file mode 100644
index 0000000..a18f997
--- /dev/null
+++ b/tests/web_bot_auth/test_wba_client_answers.py
@@ -0,0 +1,466 @@
+"""What the httpx auth does with each answer a seller, a verifier, or a proxy sends.
+
+A buyer's :class:`WebBotAuth` always hands back the response, with what it
+found out about it. It verifies a signed response, passes an unsigned refusal
+or stream through with its real status, and raises
+:class:`ResponseNotVerified`, carrying the response, only for an unverified
+``2xx`` when it requires signed responses. It signs each wire hop for its own
+URL, so a redirect never carries a signature to another URI. Each test drives
+a real httpx client against a real ASGI app or a mock transport.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import threading
+from collections.abc import Awaitable, Callable
+
+import httpx
+import pytest
+from fastapi import FastAPI
+
+from iab_agentic_primitives.web_bot_auth import (
+    CONFORMANCE_KEYS,
+    ConfigurationError,
+    DirectoryResolver,
+    HTTPRequest,
+    HTTPResponse,
+    MemoryNonceStore,
+    NonceStoreUnavailable,
+    Origin,
+    Refusal,
+    RequestSigner,
+    RequestVerifier,
+    ResponseSigner,
+    ResponseVerifier,
+    Seconds,
+    ServerIdentity,
+    StaticKeyResolver,
+)
+from iab_agentic_primitives.web_bot_auth.asgi import (
+    ASGIApp,
+    Receive,
+    RequirePolicy,
+    RequireSignatureMiddleware,
+    Scope,
+    Send,
+    SigningPolicy,
+)
+from iab_agentic_primitives.web_bot_auth.fetcher import HttpxDirectoryFetcher
+from iab_agentic_primitives.web_bot_auth.httpx import (
+    ResponseNotVerified,
+    Unsigned,
+    Verification,
+    VerificationFailed,
+    WebBotAuth,
+    sent_request,
+    verification,
+    verified_response,
+)
+from iab_agentic_primitives.web_bot_auth.rules import Streaming
+
+from . import support as w
+from .support import BUYER, SELLER, SELLER_IDENTITY, SELLER_ORIGIN
+
+COMMIT_PATH = "/proposals/prop_7/commit"
+COMMITTED = {"status": "committed", "id": "c_1"}
+
+
+def _auth(
+    resolver: StaticKeyResolver | DirectoryResolver | None = None, *, strict: bool = True
+) -> WebBotAuth:
+    """The buyer's auth: it signs, and verifies with ``resolver`` (the seller's key by default).
+
+    ``strict`` requires signed responses, as the auth does by default.
+    """
+    keys = StaticKeyResolver({SELLER_ORIGIN: [w.seller_key()]}) if resolver is None else resolver
+    signer = RequestSigner.of(w.buyer_key(), BUYER)
+    return WebBotAuth(
+        signer, ResponseVerifier(keys, keys=CONFORMANCE_KEYS), require_signed_response=strict
+    )
+
+
+def _mock(answer: Callable[[httpx.Request], httpx.Response]) -> httpx.MockTransport:
+    return httpx.MockTransport(answer)
+
+
+def _received(request: httpx.Request) -> HTTPRequest:
+    return HTTPRequest(
+        request.method, str(request.url), request.headers.multi_items(), request.content
+    )
+
+
+async def _post(auth: WebBotAuth, transport: httpx.AsyncBaseTransport, url: str) -> httpx.Response:
+    async with auth.async_client(transport=transport) as c:
+        return await c.post(url, json={"entry": 1})
+
+
+def _not_verified(call: Awaitable[httpx.Response]) -> ResponseNotVerified:
+    with pytest.raises(ResponseNotVerified) as e:
+        w.run(call)
+    return e.value
+
+
+def _failed(found: Verification | None, reason: Refusal) -> None:
+    assert isinstance(found, VerificationFailed) and found.reason is reason, found
+
+
+async def _committing(scope: Scope, receive: Receive, send: Send) -> None:
+    headers = [(b"content-type", b"application/json")]
+    await send({"type": "http.response.start", "status": 200, "headers": headers})
+    await send({"type": "http.response.body", "body": json.dumps(COMMITTED).encode()})
+
+
+# ── one test of whether a response is signed ──────────────────────────────
+
+
+CAVAGE = 'keyId="k",algorithm="hs2019",headers="date",signature="abc"'
+
+
+def test_a_response_with_another_schemes_signature_is_unsigned() -> None:
+    def answer(request: httpx.Request) -> httpx.Response:
+        return httpx.Response(200, json=COMMITTED, headers={"Signature": CAVAGE})
+
+    optional = w.run(_post(_auth(strict=False), _mock(answer), SELLER))
+    assert optional.json() == COMMITTED and isinstance(verification(optional), Unsigned)
+    refused = _not_verified(_post(_auth(), _mock(answer), SELLER))
+    assert isinstance(refused.verification, Unsigned)
+
+
+def test_a_signed_response_missing_its_signature_member_fails_and_is_never_unsigned() -> None:
+    # Signature-Input and Signature-Agent for a web-bot-auth sig9, with the Signature
+    # dropped on the way: a broken signature, not an unsigned answer.
+    agent = f'sig9="{SELLER_ORIGIN.directory_url}"'
+    signature_input = (
+        'sig9=("@status" "signature-agent";key="sig9");created=1;expires=2;'
+        'keyid="k";alg="ed25519";tag="web-bot-auth"'
+    )
+
+    def answer(request: httpx.Request) -> httpx.Response:
+        headers = {"Signature-Input": signature_input, "Signature-Agent": agent}
+        return httpx.Response(200, json=COMMITTED, headers=headers)
+
+    optional = w.run(_post(_auth(strict=False), _mock(answer), SELLER))
+    _failed(verification(optional), Refusal.SIGNATURE_MISSING)
+    _failed(
+        _not_verified(_post(_auth(), _mock(answer), SELLER)).verification, Refusal.SIGNATURE_MISSING
+    )
+
+
+# ── the responder's own origin ────────────────────────────────────────────
+
+
+def test_a_seller_on_an_idn_host_verifies_as_its_own_origin() -> None:
+    seller = Origin.parse("https://xn--bcher-kva.example")
+    signer = ResponseSigner.of(w.seller_key(), seller)
+
+    def answer(request: httpx.Request) -> httpx.Response:
+        body = json.dumps(COMMITTED).encode()
+        signed = signer.sign(HTTPResponse(200, w.JSON, body, _received(request)))
+        return httpx.Response(200, headers=signed.headers.items(), content=body)
+
+    auth = _auth(StaticKeyResolver({seller: [w.seller_key()]}))
+    # httpx reads the host as bücher.example; the identity is its A-label form.
+    response = w.run(_post(auth, _mock(answer), "https://bücher.example/commit"))
+    verified = verified_response(response)
+    assert verified is not None and verified.origin == seller and verified.bound
+
+
+def test_a_response_verifier_holds_a_responder_to_the_host_the_request_went_to() -> None:
+    request = w.sign_request()  # to the seller
+    response = w.sign_response(request, ResponseSigner.of(w.other_key(), w.OTHER))
+    verifier = ResponseVerifier(
+        StaticKeyResolver({w.OTHER_ORIGIN: [w.other_key()]}),
+        clock=lambda: w.T0,
+        keys=CONFORMANCE_KEYS,
+    )
+    w.expect_refusal(lambda: verifier.verify(response), Refusal.ORIGIN_MISMATCH)
+    assert w.run(verifier.verify(response, expected_origin=None)).origin == w.OTHER_ORIGIN
+
+
+# ── the seller's answer is never lost ─────────────────────────────────────
+
+
+def test_a_commit_the_buyer_cant_verify_still_reaches_the_buyer() -> None:
+    commits: list[int] = []
+
+    async def api(scope: Scope, receive: Receive, send: Send) -> None:
+        commits.append(1)
+        await _committing(scope, receive, send)
+
+    seller = httpx.ASGITransport(app=w.seller_signing(api))
+
+    def down(request: httpx.Request) -> httpx.Response:
+        raise httpx.ConnectError("the directory host is unreachable")
+
+    def unreachable() -> DirectoryResolver:
+        return DirectoryResolver(HttpxDirectoryFetcher(transport=_mock(down)))
+
+    refused = _not_verified(_post(_auth(unreachable()), seller, SELLER + COMMIT_PATH))
+    _failed(refused.verification, Refusal.DIRECTORY_UNAVAILABLE)
+    assert refused.response.status_code == 200 and refused.response.json() == COMMITTED
+    optional = w.run(_post(_auth(unreachable(), strict=False), seller, SELLER + COMMIT_PATH))
+    assert optional.json() == COMMITTED
+    _failed(verification(optional), Refusal.DIRECTORY_UNAVAILABLE)
+    assert len(commits) == 2
+
+
+class _Down:
+    async def check_and_record(self, origin: Origin, nonce: str, ttl: Seconds) -> bool:
+        raise NonceStoreUnavailable("the store is down")
+
+
+def test_an_unsigned_refusal_reaches_the_buyer_with_its_own_status() -> None:
+    # The seller verifies outside its response signing, so the refusal answers unsigned.
+    verifier = RequestVerifier(
+        StaticKeyResolver({BUYER: [w.buyer_key()]}),
+        identity=SELLER_IDENTITY,
+        nonces=_Down(),
+        keys=CONFORMANCE_KEYS,
+    )
+    edge = w.seller_edge(verifier)
+    app = RequireSignatureMiddleware(w.seller_signing(_committing, edge), edge)
+    response = w.run(_post(_auth(), httpx.ASGITransport(app=app), SELLER + COMMIT_PATH))
+    assert response.status_code == 503 and response.headers["retry-after"] == "1"
+    assert response.json()["error"] == "nonce-store-unavailable"
+    assert isinstance(verification(response), Unsigned)
+
+
+def test_the_servers_own_unsignable_500_and_a_proxys_502_pass_through() -> None:
+    async def no_content_type(scope: Scope, receive: Receive, send: Send) -> None:
+        await send({"type": "http.response.start", "status": 200, "headers": []})
+        await send({"type": "http.response.body", "body": b"hello"})
+
+    unsignable = httpx.ASGITransport(app=w.seller_signing(no_content_type))
+    response = w.run(_post(_auth(), unsignable, SELLER + COMMIT_PATH))
+    assert response.status_code == 500 and response.json()["error"] == "response-unsignable"
+    assert isinstance(verification(response), Unsigned)
+    proxy = _mock(lambda request: httpx.Response(502, text="bad gateway"))
+    response = w.run(_post(_auth(), proxy, SELLER + COMMIT_PATH))
+    assert response.status_code == 502 and response.text == "bad gateway"
+
+
+def test_a_sync_client_without_a_runtime_is_refused_before_it_sends() -> None:
+    sent: list[httpx.Request] = []
+
+    def answer(request: httpx.Request) -> httpx.Response:
+        sent.append(request)
+        return httpx.Response(200, json={})
+
+    with pytest.raises(ConfigurationError, match="SyncRuntime"):
+        _auth().client(transport=_mock(answer))
+    assert sent == []
+
+
+def test_the_configuration_is_not_an_httpx_auth_a_client_could_bypass() -> None:
+    # The library builds the client, so the signing transport is its one transport.
+    with pytest.raises(TypeError):
+        httpx.AsyncClient(auth=_auth())  # type: ignore[arg-type]
+
+
+@pytest.mark.parametrize("option", ["transport_factory", "mounts", "proxy", "trust_env", "app"])
+def test_a_setting_that_routes_around_the_signing_transport_is_refused(option: str) -> None:
+    options: dict[str, object] = {option: None}
+    with pytest.raises(ConfigurationError, match=option):
+        _auth().async_client(**options)  # type: ignore[arg-type]
+    with pytest.raises(ConfigurationError, match=option):
+        WebBotAuth(RequestSigner.of(w.buyer_key(), BUYER)).client(**options)  # type: ignore[arg-type]
+
+
+# ── a live event stream ───────────────────────────────────────────────────
+
+
+def test_an_event_stream_arrives_as_it_is_sent() -> None:
+    port = w.free_port()
+    identity = ServerIdentity.from_config(f"http://127.0.0.1:{port}")
+    released, finished = threading.Event(), threading.Event()
+
+    async def events(scope: Scope, receive: Receive, send: Send) -> None:
+        headers = [(b"content-type", b"text/event-stream")]
+        await send({"type": "http.response.start", "status": 200, "headers": headers})
+        await send({"type": "http.response.body", "body": b"data: 1\n\n", "more_body": True})
+        await asyncio.to_thread(released.wait, 5)  # the next event comes later
+        finished.set()
+        await send({"type": "http.response.body", "body": b"data: 2\n\n"})
+
+    async def read() -> tuple[bytes, bool, bytes, Verification | None]:
+        async with _auth().async_client() as c:
+            async with c.stream("GET", identity.base_url + "/proposals/prop_7/events") as r:
+                chunks = r.aiter_bytes()
+                first = await anext(chunks)
+                live = not finished.is_set()
+                released.set()
+                rest = b"".join([chunk async for chunk in chunks])
+                return first, live, rest, verification(r)
+
+    with w.serving(w.seller_signing(events, w.seller_edge(identity=identity)), port):
+        first, live, rest, found = w.run(read())
+    assert first == b"data: 1\n\n" and live, "the first event waited for the stream to end"
+    assert rest == b"data: 2\n\n" and isinstance(found, Unsigned)
+
+
+#: A seller that also streams NDJSON, and the rule its buyers configure to match.
+NDJSON = Streaming(("text/event-stream", "application/x-ndjson"))
+
+
+async def _ndjson(scope: Scope, receive: Receive, send: Send) -> None:
+    headers = [(b"content-type", b"application/x-ndjson")]
+    await send({"type": "http.response.start", "status": 200, "headers": headers})
+    await send({"type": "http.response.body", "body": b'{"n":1}\n{"n":2}\n'})
+
+
+def test_a_client_takes_unsigned_the_streams_its_seller_names_in_the_same_rule() -> None:
+    seller = w.seller_signing(_ndjson, policy=SigningPolicy(streaming=NDJSON))
+    signer = RequestSigner.of(w.buyer_key(), BUYER)
+    keys = StaticKeyResolver({SELLER_ORIGIN: [w.seller_key()]})
+    matched = WebBotAuth(signer, ResponseVerifier(keys, keys=CONFORMANCE_KEYS), streaming=NDJSON)
+
+    async def get(auth: WebBotAuth) -> httpx.Response:
+        async with auth.async_client(transport=httpx.ASGITransport(app=seller)) as c:
+            return await c.get(SELLER + "/proposals/prop_7/lines")
+
+    response = w.run(get(matched))
+    assert response.status_code == 200 and response.content == b'{"n":1}\n{"n":2}\n'
+    assert isinstance(verification(response), Unsigned)
+    # A client on the default rule doesn't know NDJSON streams, so it refuses the unsigned 200.
+    refused = _not_verified(get(_auth()))
+    assert isinstance(refused.verification, Unsigned)
+
+
+def test_a_signed_head_response_verifies_without_the_body_the_server_drops() -> None:
+    port = w.free_port()
+    identity = ServerIdentity.from_config(f"http://127.0.0.1:{port}")
+    api = FastAPI()
+
+    @api.api_route("/proposals/prop_7", methods=["GET", "HEAD"])
+    async def proposal() -> dict[str, str]:
+        return COMMITTED
+
+    async def head_and_get() -> tuple[httpx.Response, httpx.Response]:
+        keys = StaticKeyResolver({identity.origin: [w.seller_key()]})
+        async with _auth(keys).async_client() as c:
+            url = identity.base_url + "/proposals/prop_7"
+            return await c.head(url), await c.get(url)
+
+    with w.serving(w.seller_signing(api, w.seller_edge(identity=identity)), port):
+        head, get = w.run(head_and_get())
+    assert head.status_code == 200 and head.content == b""  # uvicorn sent no body
+    verified = verified_response(head)
+    assert verified is not None and verified.bound and not verified.body_covered
+    got = verified_response(get)
+    assert got is not None and got.body_covered and get.json() == COMMITTED
+
+
+# ── the redirect boundary ─────────────────────────────────────────────────
+
+
+def _redirecting_seller() -> tuple[ASGIApp, list[str]]:
+    """The seller, verifying every request; a route without its slash redirects to it."""
+    api = FastAPI()
+    seen: list[str] = []
+
+    @api.post(COMMIT_PATH)
+    async def commit() -> dict[str, str]:
+        return COMMITTED
+
+    verifier = RequestVerifier(
+        StaticKeyResolver({BUYER: [w.buyer_key()]}),
+        identity=SELLER_IDENTITY,
+        nonces=MemoryNonceStore(),
+        keys=CONFORMANCE_KEYS,
+    )
+    edge = w.seller_edge(verifier)
+    required = RequireSignatureMiddleware(api, edge, policy=RequirePolicy(("/proposals",)))
+
+    async def logged(scope: Scope, receive: Receive, send: Send) -> None:
+        seen.append(str(scope.get("path")))
+        await required(scope, receive, send)
+
+    return w.seller_signing(logged, edge), seen
+
+
+def test_a_redirect_is_followed_by_signing_the_next_request_afresh() -> None:
+    app, seen = _redirecting_seller()
+
+    async def follow() -> tuple[httpx.Response, httpx.Response]:
+        async with _auth().async_client(transport=httpx.ASGITransport(app=app)) as c:
+            moved = await c.post(SELLER + COMMIT_PATH + "/", json={"entry": 1})
+            assert moved.next_request is not None
+            return moved, await c.send(moved.next_request)
+
+    moved, final = w.run(follow())
+    assert moved.status_code == 307 and verified_response(moved) is not None
+    assert final.json() == COMMITTED
+    verified = verified_response(final)
+    assert verified is not None and verified.bound
+    assert seen == [COMMIT_PATH + "/", COMMIT_PATH]
+
+
+def test_a_followed_redirect_is_signed_afresh_for_its_own_url() -> None:
+    # The seller verifies every hop: a signature resent to another URL fails there.
+    app, seen = _redirecting_seller()
+
+    async def follow() -> httpx.Response:
+        transport = httpx.ASGITransport(app=app)
+        async with _auth().async_client(transport=transport, follow_redirects=True) as c:
+            return await c.post(SELLER + COMMIT_PATH + "/", json={"entry": 1})
+
+    final = w.run(follow())
+    assert final.json() == COMMITTED and [r.status_code for r in final.history] == [307]
+    verified = verified_response(final)
+    assert verified is not None and verified.bound
+    assert verified_response(final.history[0]) is not None
+    assert seen == [COMMIT_PATH + "/", COMMIT_PATH]
+
+
+def test_a_redirect_to_another_host_never_carries_the_sellers_signature() -> None:
+    received: list[HTTPRequest] = []
+    elsewhere = "https://elsewhere.example"
+
+    def answer(request: httpx.Request) -> httpx.Response:
+        received.append(_received(request))
+        if request.url.host == "seller.example.com":
+            return httpx.Response(307, headers={"Location": elsewhere + "/collect"})
+        return httpx.Response(200, json={})
+
+    async def send() -> httpx.Response:
+        auth = _auth(strict=False)
+        async with auth.async_client(transport=_mock(answer), follow_redirects=True) as c:
+            return await c.post(SELLER + COMMIT_PATH, json={"entry": 1})
+
+    final = w.run(send())
+    to_seller, to_elsewhere = received
+    assert to_elsewhere.url == elsewhere + "/collect"
+    assert to_seller.headers["signature"] != to_elsewhere.headers["signature"]
+    # What reached the other host is a signature for its own URL, and no other.
+    there = RequestVerifier(
+        StaticKeyResolver({BUYER: [w.buyer_key()]}),
+        identity=ServerIdentity.from_config(elsewhere),
+        nonces=MemoryNonceStore(),
+        keys=CONFORMANCE_KEYS,
+    )
+    assert w.run(there.verify(to_elsewhere)).origin == Origin.parse(BUYER)
+    moved = HTTPRequest(to_seller.method, to_elsewhere.url, to_seller.headers, to_seller.body)
+    w.expect_refusal(lambda: there.verify(moved), Refusal.SIGNATURE_INVALID)
+    sent = sent_request(final)
+    assert sent is not None and sent.url == to_elsewhere.url
+    assert sent.headers["signature"] == to_elsewhere.headers["signature"]
+
+
+def test_a_redirect_elsewhere_carries_none_of_the_signature() -> None:
+    def answer(request: httpx.Request) -> httpx.Response:
+        return httpx.Response(307, headers={"Location": "https://elsewhere.example/commit"})
+
+    async def send() -> httpx.Response:
+        async with _auth().async_client(transport=_mock(answer)) as c:
+            return await c.post(SELLER + COMMIT_PATH, json={"entry": 1})
+
+    moved = w.run(send())
+    assert moved.status_code == 307 and isinstance(verification(moved), Unsigned)
+    sent = sent_request(moved)
+    assert sent is not None and sent.headers["signature-input"]  # the hop itself was signed
+    follow = moved.next_request
+    assert follow is not None and follow.url.host == "elsewhere.example"
+    for name in ("signature", "signature-input", "signature-agent", "content-digest"):
+        assert name not in follow.headers, name
diff --git a/tests/web_bot_auth/test_wba_directory.py b/tests/web_bot_auth/test_wba_directory.py
new file mode 100644
index 0000000..3e1d333
--- /dev/null
+++ b/tests/web_bot_auth/test_wba_directory.py
@@ -0,0 +1,406 @@
+"""The signed key directory: building, signing, and every verification rule."""
+
+from __future__ import annotations
+
+import base64
+import json
+from typing import TypedDict, Unpack
+
+import pytest
+
+from iab_agentic_primitives.web_bot_auth import (
+    DIRECTORY_MEDIA_TYPE,
+    ConfigurationError,
+    DirectoryPublisher,
+    Ed25519Key,
+    FetchLimits,
+    Headers,
+    PublishPolicy,
+    Refusal,
+    RequestSigner,
+    UnixSeconds,
+    VerifiedDirectory,
+    publish_directory,
+    verify_directory,
+)
+from iab_agentic_primitives.web_bot_auth.conformance.fixtures import p256_public_jwk
+from iab_agentic_primitives.web_bot_auth.conformance.signing import (
+    DirectoryDeparture,
+    sign_directory_body,
+)
+from iab_agentic_primitives.web_bot_auth.directory import build_directory
+from iab_agentic_primitives.web_bot_auth.rules import DIRECTORY
+from iab_agentic_primitives.web_bot_auth.values import OMIT
+
+from . import support as w
+from .support import BUYER, BUYER_ORIGIN, T0, at, expect_refusal
+from .support import digest as content_digest
+
+
+class Limits(TypedDict, total=False):
+    """The :class:`FetchLimits` limits a test tightens."""
+
+    max_bytes: int
+    max_keys: int
+
+
+def parse(
+    status: int,
+    headers: Headers,
+    body: bytes,
+    now: UnixSeconds = T0,
+    **limits: Unpack[Limits],
+) -> VerifiedDirectory:
+    """Verifies ``(status, headers, body)`` as the buyer's directory, fetched at ``now``."""
+    response = w.fetched(status, headers, body, now=now)
+    return verify_directory(response, BUYER_ORIGIN, now, FetchLimits(**limits))
+
+
+def raw(
+    body: bytes,
+    keys: list[Ed25519Key],
+    now: UnixSeconds = T0,
+    departure: DirectoryDeparture | None = None,
+) -> dict[str, str]:
+    """The headers of ``body`` signed by ``keys`` as the buyer's directory, raw."""
+    signed = sign_directory_body(body, keys, BUYER_ORIGIN, now, departure or DirectoryDeparture())
+    return dict(signed.headers.items())
+
+
+def published(keys: list[Ed25519Key], **policy: int) -> tuple[dict[str, str], bytes]:
+    """The buyer's directory as the profile publishes it: its headers and body."""
+    answer = publish_directory(BUYER_ORIGIN, keys, now=T0, policy=PublishPolicy(**policy))
+    return dict(answer.headers.items()), answer.body
+
+
+def test_build_directory_publishes_public_jwks(buyer_key: Ed25519Key) -> None:
+    document = json.loads(build_directory([buyer_key, p256_public_jwk()]))
+    assert document["keys"][0] == buyer_key.public_jwk()
+    assert "d" not in document["keys"][0]
+    assert document["keys"][1]["kty"] == "EC"
+
+
+# RFC 8037 Appendix A: the Ed25519 key of RFC 8032 test 1, its public x, and its thumbprint.
+RFC_8032_SEED = bytes.fromhex("9d61b19deffd5a60ba844af492ec2cc44449c5697b326919703bac031cae7f60")
+RFC_8037_X = "11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo"
+RFC_8037_KID = "kPrK_qmxVWaYVA9wwBF6Iuo3vVzz7TxHCTwXBygrS4k"  # gitleaks:allow
+
+
+def test_a_key_is_published_and_signs_under_its_rfc_8037_thumbprint() -> None:
+    key = Ed25519Key.from_seed(RFC_8032_SEED)
+    status, lines, body = w.signed_directory(BUYER, [key])
+    headers = dict(lines.items())
+    (jwk,) = json.loads(body)["keys"]
+    assert jwk == {
+        "kty": "OKP",
+        "crv": "Ed25519",
+        "kid": RFC_8037_KID,
+        "x": RFC_8037_X,
+        "use": "sig",
+    }
+    assert list(parse(status, headers, body).keys) == [RFC_8037_KID]
+    signed = RequestSigner.of(key, BUYER).sign(w.commit(), now=T0)
+    assert f'keyid="{RFC_8037_KID}"' in (signed.headers.get("signature-input") or "")
+    verifier = w.request_verifier(resolver=w.directory_resolver({BUYER: [key]}))
+    assert w.run(verifier.verify(signed)).keyid == RFC_8037_KID
+
+
+def test_signed_directory_verifies(buyer_key: Ed25519Key) -> None:
+    status, lines, body = w.signed_directory(BUYER, [buyer_key])
+    headers = dict(lines.items())
+    assert headers["Content-Type"] == DIRECTORY_MEDIA_TYPE
+    assert headers["Content-Digest"] == content_digest(body)
+    assert headers["Signature-Input"].startswith(f"key1={w.inner_list(DIRECTORY.components())};")
+    assert 'tag="http-message-signatures-directory"' in headers["Signature-Input"]
+    directory = parse(status, headers, body)
+    assert list(directory.keys) == [buyer_key.thumbprint]
+    assert directory.expires == at(86400)
+
+
+def test_every_key_signs_and_the_earliest_expires_wins(
+    buyer_key: Ed25519Key, other_key: Ed25519Key
+) -> None:
+    body = build_directory([buyer_key, other_key])
+    headers = raw(body, [buyer_key, other_key])
+    directory = parse(200, headers, body)
+    assert set(directory.keys) == {buyer_key.thumbprint, other_key.thumbprint}
+    later = raw(body, [other_key], at(100), DirectoryDeparture(expires=1000))
+    mixed = dict(headers)
+    mixed["Signature-Input"] = (
+        headers["Signature-Input"].split(", ")[0]
+        + ", "
+        + later["Signature-Input"].replace("key1=", "key2=")
+    )
+    mixed["Signature"] = (
+        headers["Signature"].split(", ")[0] + ", " + later["Signature"].replace("key1=", "key2=")
+    )
+    assert parse(200, mixed, body, now=at(100)).expires == at(1100)
+
+
+def test_media_type_parameters_are_allowed(buyer_key: Ed25519Key) -> None:
+    status, lines, body = w.signed_directory(BUYER, [buyer_key])
+    headers = dict(lines.items())
+    headers["Content-Type"] = DIRECTORY_MEDIA_TYPE + "; charset=utf-8"
+    assert parse(status, headers, body).origin == BUYER_ORIGIN
+
+
+def test_keys_of_other_types_are_ignored(buyer_key: Ed25519Key) -> None:
+    body = build_directory([buyer_key, p256_public_jwk()])
+    headers = raw(body, [buyer_key])
+    assert list(parse(200, headers, body).keys) == [buyer_key.thumbprint]
+
+
+@pytest.mark.parametrize("status", [201, 204, 301, 302, 404, 500])
+def test_status_must_be_200(buyer_key: Ed25519Key, status: int) -> None:
+    _, lines, body = w.signed_directory(BUYER, [buyer_key])
+    headers = dict(lines.items())
+    expect_refusal(lambda: parse(status, headers, body), Refusal.DIRECTORY_STATUS)
+
+
+@pytest.mark.parametrize("media_type", ["application/json", "application/jwk-set+json", None])
+def test_media_type(buyer_key: Ed25519Key, media_type: str | None) -> None:
+    _, lines, body = w.signed_directory(BUYER, [buyer_key])
+    headers = dict(lines.items())
+    if media_type is None:
+        del headers["Content-Type"]
+    else:
+        headers["Content-Type"] = media_type
+    expect_refusal(lambda: parse(200, headers, body), Refusal.DIRECTORY_MEDIA_TYPE)
+
+
+def test_body_cap(buyer_key: Ed25519Key) -> None:
+    _, lines, body = w.signed_directory(BUYER, [buyer_key])
+    headers = dict(lines.items())
+    expect_refusal(
+        lambda: parse(200, headers, body, max_bytes=len(body) - 1), Refusal.DIRECTORY_TOO_LARGE
+    )
+
+
+def test_key_count_cap(buyer_key: Ed25519Key, other_key: Ed25519Key) -> None:
+    _, lines, body = w.signed_directory(BUYER, [buyer_key, other_key])
+    headers = dict(lines.items())
+    expect_refusal(lambda: parse(200, headers, body, max_keys=1), Refusal.DIRECTORY_TOO_MANY_KEYS)
+    padded = build_directory([buyer_key] + [p256_public_jwk()] * 16)
+    signed = raw(padded, [buyer_key])
+    expect_refusal(lambda: parse(200, signed, padded), Refusal.DIRECTORY_TOO_MANY_KEYS)
+
+
+def test_content_digest_missing_or_wrong(buyer_key: Ed25519Key) -> None:
+    _, lines, body = w.signed_directory(BUYER, [buyer_key])
+    headers = dict(lines.items())
+    expect_refusal(lambda: parse(200, headers, body + b"\n"), Refusal.DIRECTORY_CONTENT_DIGEST)
+    del headers["Content-Digest"]
+    expect_refusal(lambda: parse(200, headers, body), Refusal.DIRECTORY_CONTENT_DIGEST)
+
+
+@pytest.mark.parametrize("body", [b"not json", b"[]", b'{"keys": {}}'])
+def test_body_must_be_a_jwk_set(body: bytes) -> None:
+    headers = {"Content-Type": DIRECTORY_MEDIA_TYPE, "Content-Digest": content_digest(body)}
+    expect_refusal(lambda: parse(200, headers, body), Refusal.DIRECTORY_FORMAT)
+
+
+def test_an_ed25519_key_that_is_not_32_bytes_is_a_format_refusal(buyer_key: Ed25519Key) -> None:
+    body = build_directory([buyer_key, {"kty": "OKP", "crv": "Ed25519", "x": "AAAA"}])
+    headers = raw(body, [buyer_key])
+    expect_refusal(lambda: parse(200, headers, body), Refusal.DIRECTORY_FORMAT)
+
+
+def test_no_ed25519_key() -> None:
+    body = build_directory([p256_public_jwk()])
+    headers = {"Content-Type": DIRECTORY_MEDIA_TYPE, "Content-Digest": content_digest(body)}
+    expect_refusal(lambda: parse(200, headers, body), Refusal.DIRECTORY_NO_USABLE_KEY)
+
+
+def test_kid_must_be_the_thumbprint(buyer_key: Ed25519Key) -> None:
+    jwk = {**buyer_key.public_jwk(), "kid": "operator-chosen"}
+    body = build_directory([jwk])
+    headers = raw(body, [buyer_key])
+    expect_refusal(lambda: parse(200, headers, body), Refusal.DIRECTORY_KID)
+
+
+def test_an_ed25519_key_that_does_not_sign(buyer_key: Ed25519Key, other_key: Ed25519Key) -> None:
+    body = build_directory([buyer_key, other_key])
+    headers = raw(body, [buyer_key])
+    expect_refusal(lambda: parse(200, headers, body), Refusal.DIRECTORY_ONE_SIGNATURE_PER_KEY)
+
+
+def test_unsigned_directory(buyer_key: Ed25519Key) -> None:
+    body = build_directory([buyer_key])
+    headers = {"Content-Type": DIRECTORY_MEDIA_TYPE, "Content-Digest": content_digest(body)}
+    expect_refusal(lambda: parse(200, headers, body), Refusal.DIRECTORY_ONE_SIGNATURE_PER_KEY)
+
+
+def test_two_signatures_by_one_key(buyer_key: Ed25519Key) -> None:
+    body = build_directory([buyer_key])
+    headers = raw(body, [buyer_key, buyer_key])
+    expect_refusal(lambda: parse(200, headers, body), Refusal.DIRECTORY_ONE_SIGNATURE_PER_KEY)
+
+
+def test_signed_for_another_authority(buyer_key: Ed25519Key) -> None:
+    _, lines, body = w.signed_directory(BUYER, [buyer_key])
+    headers = dict(lines.items())
+    headers = raw(body, [buyer_key], departure=DirectoryDeparture(authority="other.example.com"))
+    expect_refusal(lambda: parse(200, headers, body), Refusal.DIRECTORY_SIGNATURE)
+
+
+@pytest.mark.parametrize(
+    ("departure", "expected"),
+    [
+        (DirectoryDeparture(components=DIRECTORY.components()[:1]), Refusal.DIRECTORY_COMPONENTS),
+        (DirectoryDeparture(components=DIRECTORY.components()[1:]), Refusal.DIRECTORY_COMPONENTS),
+        (DirectoryDeparture(created=3600, expires=90000), Refusal.DIRECTORY_WINDOW),
+        (DirectoryDeparture(created=-7200, expires=-3600), Refusal.DIRECTORY_WINDOW),
+        # Valid at now on both ends, but expires comes before created.
+        (DirectoryDeparture(created=60, expires=30), Refusal.DIRECTORY_WINDOW),
+    ],
+)
+def test_signature_rules(
+    buyer_key: Ed25519Key, departure: DirectoryDeparture, expected: Refusal
+) -> None:
+    body = build_directory([buyer_key])
+    expect_refusal(lambda: parse(200, raw(body, [buyer_key], departure=departure), body), expected)
+
+
+def test_directory_clock_skew(buyer_key: Ed25519Key) -> None:
+    body = build_directory([buyer_key])
+    headers = raw(body, [buyer_key], departure=DirectoryDeparture(created=60))
+    assert parse(200, headers, body).origin == BUYER_ORIGIN
+
+
+def test_wrong_tag(buyer_key: Ed25519Key) -> None:
+    _, lines, body = w.signed_directory(BUYER, [buyer_key])
+    headers = dict(lines.items())
+    headers["Signature-Input"] = headers["Signature-Input"].replace(
+        "http-message-signatures-directory", "web-bot-auth"
+    )
+    expect_refusal(lambda: parse(200, headers, body), Refusal.DIRECTORY_TAG)
+
+
+def test_tampered_signature(buyer_key: Ed25519Key) -> None:
+    _, lines, body = w.signed_directory(BUYER, [buyer_key])
+    headers = dict(lines.items())
+    headers["Signature"] = "key1=:" + "A" * 86 + "==:"
+    expect_refusal(lambda: parse(200, headers, body), Refusal.DIRECTORY_SIGNATURE)
+
+
+def test_unparseable_signature_fields(buyer_key: Ed25519Key) -> None:
+    _, lines, body = w.signed_directory(BUYER, [buyer_key])
+    headers = dict(lines.items())
+    headers["Signature-Input"] = "key1=("
+    expect_refusal(lambda: parse(200, headers, body), Refusal.DIRECTORY_SIGNATURE_PARSE)
+
+
+def test_publishing_needs_a_key() -> None:
+    with pytest.raises(ConfigurationError):
+        publish_directory(BUYER_ORIGIN, [], now=T0)
+
+
+@pytest.mark.parametrize(
+    "keys",
+    [[w.buyer_key(), w.buyer_key()], [w.key(f"directory-{i}") for i in range(17)]],
+    ids=["a-key-twice", "seventeen-keys"],
+)
+def test_a_live_key_source_never_publishes_what_verifiers_refuse(keys: list[Ed25519Key]) -> None:
+    # One keyfile in both rotation slots, or one key too many: every verifier refuses
+    # the directory, so the publisher refuses it on the answer instead of serving it.
+    publisher = DirectoryPublisher(BUYER_ORIGIN, lambda: keys)
+    with pytest.raises(ConfigurationError):
+        w.run(publisher.answer(T0))
+    assert w.run(DirectoryPublisher(BUYER_ORIGIN, lambda: keys[:1]).answer(T0)).status == 200
+
+
+# ── review regressions ────────────────────────────────────────────────────
+
+
+def _resign(
+    buyer_key: Ed25519Key, body: bytes, *, digest: str | None = None, alg: str | None = "ed25519"
+) -> dict[str, str]:
+    """Signs ``body`` as the buyer's directory, with a chosen Content-Digest and alg."""
+    departure = DirectoryDeparture(
+        content_digest=digest, alg=OMIT if alg is None else alg, expires=600
+    )
+    return raw(body, [buyer_key], departure=departure)
+
+
+def test_a_directory_digest_without_sha_256_is_refused(buyer_key: Ed25519Key) -> None:
+    body = build_directory([buyer_key])
+    sha512 = w.digest_without_sha256(body)
+    expect_refusal(
+        lambda: parse(200, _resign(buyer_key, body, digest=sha512), body),
+        Refusal.DIRECTORY_CONTENT_DIGEST,
+    )
+
+
+@pytest.mark.parametrize("alg", [None, "ed25519"])
+def test_a_directory_signature_may_omit_alg(buyer_key: Ed25519Key, alg: str | None) -> None:
+    body = build_directory([buyer_key])
+    assert parse(200, _resign(buyer_key, body, alg=alg), body).origin == BUYER_ORIGIN
+
+
+def test_a_directory_signature_with_another_alg_is_refused(buyer_key: Ed25519Key) -> None:
+    body = build_directory([buyer_key])
+    expect_refusal(
+        lambda: parse(200, _resign(buyer_key, body, alg="rsa-pss-sha512"), body),
+        Refusal.DIRECTORY_SIGNATURE,
+    )
+
+
+@pytest.mark.parametrize(("created", "ok"), [(60, True), (61, False)])
+def test_a_directory_signature_gets_the_same_60_second_skew(
+    buyer_key: Ed25519Key, created: int, ok: bool
+) -> None:
+    body = build_directory([buyer_key])
+    args = (200, raw(body, [buyer_key], departure=DirectoryDeparture(created=created)), body)
+    if ok:
+        assert parse(*args).origin == BUYER_ORIGIN
+    else:
+        expect_refusal(lambda: parse(*args), Refusal.DIRECTORY_WINDOW)
+
+
+def test_a_deeply_nested_body_is_a_format_refusal_not_a_crash(buyer_key: Ed25519Key) -> None:
+    body = b"[" * 100_000 + b"]" * 100_000
+    headers = {"Content-Type": DIRECTORY_MEDIA_TYPE, "Content-Digest": content_digest(body)}
+    expect_refusal(lambda: parse(200, headers, body, max_bytes=len(body)), Refusal.DIRECTORY_FORMAT)
+
+
+def test_a_body_that_is_not_utf_8_is_refused(buyer_key: Ed25519Key) -> None:
+    # UTF-16 with a byte order mark: json.loads on bytes would detect and accept it.
+    body = json.dumps({"keys": [buyer_key.public_jwk()]}).encode("utf-16")
+    assert json.loads(body)["keys"]
+    expect_refusal(lambda: parse(200, _resign(buyer_key, body), body), Refusal.DIRECTORY_FORMAT)
+
+
+def test_evidence_keeps_the_exact_body_bytes(buyer_key: Ed25519Key) -> None:
+    _, lines, body = w.signed_directory(BUYER, [buyer_key])
+    headers = dict(lines.items())
+    evidence = parse(200, headers, body).evidence.document()
+    body_base64 = evidence["body_base64"]
+    assert isinstance(body_base64, str)
+    assert base64.b64decode(body_base64) == body
+
+
+def test_a_directory_verifies_until_its_expires_and_not_one_second_after(
+    buyer_key: Ed25519Key,
+) -> None:
+    body = build_directory([buyer_key])
+    departure = DirectoryDeparture(created=-600, expires=0)
+    args = (200, raw(body, [buyer_key], departure=departure), body)
+    assert parse(*args, now=T0).expires == T0  # the boundary second
+    expect_refusal(lambda: parse(*args, now=at(1)), Refusal.DIRECTORY_WINDOW)  # no skew on expires
+
+
+@pytest.mark.parametrize("max_age", [0, 120, 300])
+def test_max_age_sets_cache_control(buyer_key: Ed25519Key, max_age: int) -> None:
+    headers, body = published([buyer_key], max_age=max_age)
+    assert headers["Cache-Control"] == f"max-age={max_age}"
+    assert parse(200, headers, body).origin == BUYER_ORIGIN
+
+
+def test_the_default_max_age_is_300(buyer_key: Ed25519Key) -> None:
+    assert published([buyer_key])[0]["Cache-Control"] == "max-age=300"
+
+
+@pytest.mark.parametrize("max_age", [-1, 1.5, "300", True])
+def test_max_age_must_be_whole_seconds_and_not_negative(max_age: object) -> None:
+    with pytest.raises(ConfigurationError):
+        PublishPolicy(max_age=max_age)  # type: ignore[arg-type]
diff --git a/tests/web_bot_auth/test_wba_docs.py b/tests/web_bot_auth/test_wba_docs.py
new file mode 100644
index 0000000..6c5bf56
--- /dev/null
+++ b/tests/web_bot_auth/test_wba_docs.py
@@ -0,0 +1,193 @@
+"""WEB_BOT_AUTH.md states the API, the refusals, and the interop result as the code has them."""
+
+from __future__ import annotations
+
+import ast
+import enum
+import importlib
+import inspect
+import pkgutil
+import re
+from collections.abc import Iterator
+from pathlib import Path
+from types import ModuleType
+from typing import ForwardRef, TypeVar
+
+from iab_agentic_primitives.web_bot_auth import Refusal
+
+DOC = (Path(__file__).resolve().parents[2] / "WEB_BOT_AUTH.md").read_text()
+
+
+def _section(heading: str) -> str:
+    start = DOC.index(heading)
+    return DOC[start : DOC.index("\n## ", start + len(heading))]
+
+
+def test_the_module_table_lists_each_modules_all() -> None:
+    rows = re.findall(r"^\| `([a-z_]+)` \| [^|]* \| (.*) \|$", _section("## Modules"), re.M)
+    assert rows
+    for module, names in rows:
+        listed = re.findall(r"`([A-Za-z_0-9]+)`", names)
+        code = importlib.import_module(f"iab_agentic_primitives.web_bot_auth.{module}").__all__
+        assert listed == list(code), module
+
+
+def test_the_root_export_list_is_the_roots_all() -> None:
+    block = _section("## Modules").split("```text\n", 1)[1].split("\n```", 1)[0]
+    root = importlib.import_module("iab_agentic_primitives.web_bot_auth")
+    assert block.splitlines() == list(root.__all__)
+
+
+def test_every_public_module_sorts_its_all() -> None:
+    rows = re.findall(r"^\| `([a-z_]+)` \|", _section("## Modules"), re.M)
+    for module in ["", *rows]:
+        name = "iab_agentic_primitives.web_bot_auth" + (f".{module}" if module else "")
+        exported = list(importlib.import_module(name).__all__)
+        constants = [n for n in exported if n.isupper()]
+        classes = [n for n in exported if n[0].isupper() and not n.isupper()]
+        rest = [n for n in exported if not n[0].isupper()]
+        assert exported == sorted(constants) + sorted(classes) + sorted(rest), name
+
+
+def test_the_refusal_table_is_the_refusal_enum() -> None:
+    table = _section("### Verification procedure")
+    by_status: dict[int, set[str]] = {}
+    for status, cell in re.findall(r"^\| `(\d{3})` \| (.*) \|$", table, re.M):
+        by_status[int(status)] = set(re.findall(r"`([a-z-]+)`", cell))
+    expected: dict[int, set[str]] = {}
+    for refusal in Refusal:
+        expected.setdefault(refusal.status, set()).add(refusal.code)
+    assert by_status == expected
+
+
+# ── every type a public signature names is exported ───────────────────────
+
+PACKAGE = "iab_agentic_primitives.web_bot_auth"
+
+
+def test_the_verifier_names_the_steps_of_the_procedure() -> None:
+    from iab_agentic_primitives.web_bot_auth import verifier
+
+    procedure = " ".join(_section("### Verification procedure").split())
+    docstring = " ".join((verifier.__doc__ or "").split())
+    in_guide = set(re.findall(r"\*\*(\w[^*]*?)\.\*\*", procedure))
+    in_code = set(re.findall(r'"([A-Z][a-z]+ the [a-z ]+)"', docstring))
+    assert in_guide == in_code, in_guide ^ in_code
+
+
+def _modules() -> dict[str, ModuleType]:
+    """Every module of the package, private ones included, by name; not the CLI entry point."""
+    root = importlib.import_module(PACKAGE)
+    found = {PACKAGE: root}
+    for info in pkgutil.walk_packages(root.__path__, f"{PACKAGE}."):
+        if not info.name.endswith(".__main__"):
+            found[info.name] = importlib.import_module(info.name)
+    return found
+
+
+MODULES = _modules()
+#: The public modules: no part of the name after the package starts with ``_``.
+PUBLIC = {
+    name: module
+    for name, module in MODULES.items()
+    if not any(part.startswith("_") for part in name.removeprefix(PACKAGE).split("."))
+}
+
+
+def _top_level_names(module: ModuleType) -> set[str]:
+    """The names a module's own source defines at the top level."""
+    assert module.__file__ is not None
+    names: set[str] = set()
+    for node in ast.parse(Path(module.__file__).read_text()).body:
+        if isinstance(node, (ast.ClassDef, ast.FunctionDef, ast.AsyncFunctionDef)):
+            names.add(node.name)
+        elif isinstance(node, ast.Assign):
+            names.update(t.id for t in node.targets if isinstance(t, ast.Name))
+        elif isinstance(node, ast.AnnAssign) and isinstance(node.target, ast.Name):
+            names.add(node.target.id)
+    return names
+
+
+DEFINED = {name: _top_level_names(module) for name, module in MODULES.items()}
+EXPORTED = {id(getattr(m, n)) for m in PUBLIC.values() for n in getattr(m, "__all__", ())}
+
+
+def _home(module: ModuleType, name: str) -> str | None:
+    """The package module that defines what ``name`` is in ``module``, if the package does."""
+    value = vars(module).get(name)
+    if value is None or isinstance(value, TypeVar):
+        return None
+    for home, defined in DEFINED.items():
+        if name in defined and vars(MODULES[home]).get(name) is value:
+            return home
+    return None
+
+
+def _members(cls: type) -> Iterator[tuple[str, object]]:
+    """A class's own public functions and properties, unwrapped to their functions."""
+    for name, attribute in vars(cls).items():
+        if name.startswith("_") and name not in ("__init__", "__call__"):
+            continue
+        if isinstance(attribute, (classmethod, staticmethod)):
+            yield name, attribute.__func__
+        elif isinstance(attribute, property):
+            yield name, attribute.fget
+        else:
+            yield name, attribute
+
+
+def _arguments(where: str, function: object) -> Iterator[tuple[str, object]]:
+    """``(where, annotation)`` for each public argument of ``function``."""
+    for argument, annotation in getattr(function, "__annotations__", {}).items():
+        if not argument.startswith("_"):
+            yield f"{where}({argument})", annotation
+
+
+def _annotations(value: object) -> Iterator[tuple[str, object]]:
+    """``(where, annotation)`` for each annotation of a public function or class."""
+    if inspect.isfunction(value):
+        yield from _arguments(value.__name__, value)
+    if not isinstance(value, type) or issubclass(value, enum.Enum):
+        return
+    for field, annotation in vars(value).get("__annotations__", {}).items():
+        if not field.startswith("_"):
+            yield f"{value.__name__}.{field}", annotation
+    for name, member in _members(value):
+        if inspect.isfunction(member):
+            yield from _arguments(f"{value.__name__}.{name}", member)
+
+
+def _names(annotation: object) -> Iterator[str]:
+    """The names an annotation's text refers to (every module defers annotations).
+
+    A generated ``__init__``, such as a dataclass's, annotates its return as ``None``.
+    The strings inside an annotation are ``Literal`` values, not names. Before
+    Python 3.14, a ``NamedTuple`` keeps a field's deferred annotation as a ``ForwardRef``.
+    """
+    if annotation is None:
+        return
+    if isinstance(annotation, ForwardRef):
+        annotation = annotation.__forward_arg__
+    assert isinstance(annotation, str), annotation
+    for node in ast.walk(ast.parse(annotation, mode="eval")):
+        if isinstance(node, ast.Name):
+            yield node.id
+
+
+def test_every_type_a_public_signature_names_is_exported() -> None:
+    unexported = set()
+    for module_name, module in PUBLIC.items():
+        for name in module.__all__:
+            home = MODULES[_home(module, name) or module_name]
+            for where, annotation in _annotations(getattr(module, name)):
+                for used in _names(annotation):
+                    source = _home(home, used)
+                    if source is not None and id(vars(home)[used]) not in EXPORTED:
+                        unexported.add(f"{module_name}.{name}: {where} names {source}.{used}")
+    assert sorted(unexported) == []
+
+
+def test_the_module_table_lists_every_public_module() -> None:
+    rows = re.findall(r"^\| `([a-z_]+)` \|", _section("## Modules"), re.M)
+    top = {name.removeprefix(f"{PACKAGE}.") for name in PUBLIC if name.count(".") == 2}
+    assert sorted(rows) == sorted(top)
diff --git a/tests/web_bot_auth/test_wba_http_integration.py b/tests/web_bot_auth/test_wba_http_integration.py
new file mode 100644
index 0000000..dbf20b0
--- /dev/null
+++ b/tests/web_bot_auth/test_wba_http_integration.py
@@ -0,0 +1,997 @@
+"""The httpx auth and the ASGI helpers, end to end in process.
+
+A buyer client signs with :class:`WebBotAuth`; a FastAPI seller verifies the
+request, resolving the buyer's key only through the buyer's own directory
+route, and signs its response; the client verifies the response and its
+binding through the seller's directory route. Neither side is configured with
+the other's key.
+"""
+
+from __future__ import annotations
+
+import json
+from collections.abc import Awaitable, Callable, Mapping
+from dataclasses import replace
+from typing import TypedDict, Unpack
+
+import httpx
+import pytest
+from fastapi import FastAPI, Request
+from fastapi.responses import JSONResponse, Response, StreamingResponse
+
+from iab_agentic_primitives.web_bot_auth import (
+    CONFORMANCE_KEYS,
+    DIRECTORY_MEDIA_TYPE,
+    DIRECTORY_PATH,
+    ConfigurationError,
+    DirectoryPublisher,
+    DirectoryResolver,
+    Ed25519Key,
+    HTTPRequest,
+    HTTPResponse,
+    MemoryNonceStore,
+    NonceStoreUnavailable,
+    Origin,
+    PublishPolicy,
+    Refusal,
+    RequestSigner,
+    RequestVerifier,
+    ResponseSigner,
+    ResponseVerifier,
+    Seconds,
+    ServerIdentity,
+    StaticKeyResolver,
+    WebBotAuthError,
+    accept_signature,
+    publish_directory,
+    refusal_response,
+    system_clock,
+    verify_directory,
+)
+from iab_agentic_primitives.web_bot_auth.asgi import (
+    ASGIApp,
+    DirectoryMiddleware,
+    OnUnsigned,
+    Receive,
+    RequirePolicy,
+    RequireSignatureMiddleware,
+    ResponseSigningMiddleware,
+    Scope,
+    Send,
+    ServerEdge,
+    request_url,
+)
+from iab_agentic_primitives.web_bot_auth.fetcher import HttpxDirectoryFetcher
+from iab_agentic_primitives.web_bot_auth.httpx import (
+    Expect,
+    ResponseNotVerified,
+    Unsigned,
+    VerificationFailed,
+    WebBotAuth,
+    sent_request,
+    verification,
+    verified_response,
+)
+from iab_agentic_primitives.web_bot_auth.sync import SyncRequestVerifier, SyncRuntime
+from iab_agentic_primitives.web_bot_auth.testing import directory_transport
+
+from . import support as w
+from .support import (
+    BUYER,
+    BUYER_ORIGIN,
+    JSON,
+    SELLER,
+    SELLER_IDENTITY,
+    SELLER_ORIGIN,
+    T0,
+    expect_refusal,
+)
+
+COMMIT = json.loads(w.COMMIT_BODY)
+COMMIT_PATH = "/proposals/prop_7/commit"
+JSON_RAW = [(k.lower().encode(), v.encode()) for k, v in JSON.items()]
+
+
+class Router(httpx.AsyncBaseTransport):
+    """Routes each request to the in-process app for its host."""
+
+    def __init__(self, apps: Mapping[str, ASGIApp]) -> None:
+        self.transports = {host: httpx.ASGITransport(app=app) for host, app in apps.items()}
+
+    async def handle_async_request(self, request: httpx.Request) -> httpx.Response:
+        return await self.transports[request.url.host].handle_async_request(request)
+
+
+def seller_app(
+    router_ref: httpx.AsyncBaseTransport,
+    *,
+    identity: ServerIdentity = SELLER_IDENTITY,
+    on_unsigned: OnUnsigned = "refuse",
+) -> ResponseSigningMiddleware:
+    app = FastAPI()
+
+    @app.post("/proposals/{proposal_id}/commit")
+    async def commit(proposal_id: str, request: Request) -> JSONResponse:
+        identity = getattr(request.state, "web_bot_auth", None)
+        body = await request.json()
+        return JSONResponse(
+            {"entries": [body["entry"]], "signed_by": str(identity.origin) if identity else None}
+        )
+
+    @app.get("/proposals/{proposal_id}/events")
+    async def events(proposal_id: str) -> StreamingResponse:
+        return StreamingResponse(iter([b"data: 1\n\n"]), media_type="text/event-stream")
+
+    @app.get("/health")
+    async def health() -> dict[str, bool]:
+        return {"ok": True}
+
+    verifier = RequestVerifier(
+        DirectoryResolver(HttpxDirectoryFetcher(transport=router_ref)),
+        identity=identity,
+        nonces=MemoryNonceStore(),
+        keys=CONFORMANCE_KEYS,
+    )
+    edge = w.seller_edge(verifier)
+    required = RequireSignatureMiddleware(
+        app,
+        edge,
+        policy=RequirePolicy(prefixes=("/proposals",), on_unsigned=on_unsigned),
+    )
+    return w.seller_signing(required, edge)
+
+
+def buyer_app() -> DirectoryMiddleware:
+    app = FastAPI()
+    return DirectoryMiddleware(app, DirectoryPublisher(BUYER_ORIGIN, [w.buyer_key()]))
+
+
+class LateRouter(httpx.AsyncBaseTransport):
+    """A router whose apps are set after construction, so the seller can resolve through it."""
+
+    router: Router
+    #: The seller's public base URL.
+    base_url: str = SELLER
+
+    async def handle_async_request(self, request: httpx.Request) -> httpx.Response:
+        return await self.router.handle_async_request(request)
+
+
+#: The seller on a port other than 443: its identity is still https://seller.example.com.
+PORTED = ServerIdentity.from_config("https://seller.example.com:8443")
+#: The seller's identities, for the tests that run on each.
+IDENTITIES = pytest.mark.parametrize(
+    "network", [SELLER_IDENTITY, PORTED], ids=["default-port", "port-8443"], indirect=True
+)
+
+
+@pytest.fixture
+def network(request: pytest.FixtureRequest) -> LateRouter:
+    """The buyer and the seller, routed by host; the seller's identity is the parameter."""
+    identity: ServerIdentity = getattr(request, "param", SELLER_IDENTITY)
+    late = LateRouter()
+    late.router = Router(
+        {
+            "seller.example.com": seller_app(late, identity=identity),
+            "buyer.example.com": buyer_app(),
+        }
+    )
+    late.base_url = identity.base_url
+    return late
+
+
+class AuthOptions(TypedDict, total=False):
+    """The :class:`WebBotAuth` keyword options a test passes through :func:`client`."""
+
+    expect: Expect
+    require_signed_response: bool
+
+
+def client(network: LateRouter, **auth_options: Unpack[AuthOptions]) -> httpx.AsyncClient:
+    auth = WebBotAuth(
+        RequestSigner.of(w.buyer_key(), BUYER),
+        ResponseVerifier(
+            DirectoryResolver(HttpxDirectoryFetcher(transport=network)), keys=CONFORMANCE_KEYS
+        ),
+        **auth_options,
+    )
+    return auth.async_client(transport=network)
+
+
+async def _commit(network: LateRouter, **auth_options: Unpack[AuthOptions]) -> httpx.Response:
+    async with client(network, **auth_options) as c:
+        return await c.post(network.base_url + COMMIT_PATH, json=COMMIT)
+
+
+def test_a_url_with_an_empty_query_is_sent_signed_and_answered_as_one(
+    network: LateRouter,
+) -> None:
+    async def post() -> httpx.Response:
+        async with client(network) as c:
+            return await c.post(SELLER + COMMIT_PATH + "?", json=COMMIT)
+
+    response = w.run(post())
+    assert response.status_code == 200 and response.json()["signed_by"] == BUYER
+    assert verified_response(response) is not None
+    sent = sent_request(response)
+    assert sent is not None and sent.url == SELLER + COMMIT_PATH  # sent as signed
+
+
+@pytest.mark.parametrize("suffix", ["#terms", "?#terms"], ids=["fragment", "empty-query-fragment"])
+def test_a_url_with_a_fragment_is_signed_and_answered_without_it(
+    network: LateRouter, suffix: str
+) -> None:
+    async def post() -> httpx.Response:
+        async with client(network) as c:
+            return await c.post(SELLER + COMMIT_PATH + suffix, json=COMMIT)
+
+    response = w.run(post())
+    assert response.status_code == 200 and response.json()["signed_by"] == BUYER
+    assert verified_response(response) is not None
+    sent = sent_request(response)
+    assert sent is not None and sent.url == SELLER + COMMIT_PATH
+
+
+async def _proposal(scope: Scope, receive: Receive, send: Send) -> None:
+    await send({"type": "http.response.start", "status": 200, "headers": [*JSON_RAW]})
+    await send({"type": "http.response.body", "body": b'{"ok":true}'})
+
+
+@pytest.mark.parametrize("suffix", ["?", "#terms", "?#terms"])
+def test_a_verify_only_client_takes_the_signed_answer_to_a_url_it_wrote_loosely(
+    suffix: str,
+) -> None:
+    keys = StaticKeyResolver({SELLER_ORIGIN: [w.seller_key()]})
+    auth = WebBotAuth.verify_only(ResponseVerifier(keys, keys=CONFORMANCE_KEYS))
+    transport = httpx.ASGITransport(app=w.seller_signing(_proposal))
+
+    async def get() -> httpx.Response:
+        async with auth.async_client(transport=transport) as c:
+            return await c.get(SELLER + "/proposals/prop_7" + suffix)
+
+    verified = verified_response(w.run(get()))
+    assert verified is not None and verified.origin == SELLER_ORIGIN
+
+
+@pytest.mark.parametrize("suffix", ["?", "#terms", "?#terms"])
+def test_a_response_verifier_reads_the_url_a_caller_wrote_as_the_server_rebuilt_it(
+    suffix: str,
+) -> None:
+    # The server rebuilt the request without the fragment or the empty query.
+    rebuilt = HTTPRequest("GET", SELLER + "/proposals/prop_7")
+    signer = ResponseSigner.of(w.seller_key(), SELLER)
+    answered = signer.sign(HTTPResponse(200, JSON, b'{"ok":true}', rebuilt))
+    as_written = HTTPRequest("GET", SELLER + "/proposals/prop_7" + suffix)
+    keys = StaticKeyResolver({SELLER_ORIGIN: [w.seller_key()]})
+    verifier = ResponseVerifier(keys, keys=CONFORMANCE_KEYS)
+    received = HTTPResponse(200, answered.headers, answered.body, as_written)
+    assert w.run(verifier.verify(received)).origin == SELLER_ORIGIN
+
+
+@IDENTITIES
+def test_buyer_and_seller_agree_through_discovery_only(network: LateRouter) -> None:
+    response = w.run(_commit(network))
+    assert response.status_code == 200
+    assert (
+        response.json()["signed_by"] == BUYER
+    )  # the seller attributed the request to the buyer's origin
+    verified = verified_response(response)
+    assert verified is not None
+    assert verified.origin == SELLER_ORIGIN and verified.bound and verified.body_covered
+
+
+@IDENTITIES
+def test_directory_route_serves_a_signed_directory(network: LateRouter) -> None:
+    async def fetch() -> tuple[httpx.Response, httpx.Response, httpx.Response]:
+        async with httpx.AsyncClient(transport=network) as c:
+            return (
+                await c.get(SELLER + DIRECTORY_PATH),
+                await c.head(SELLER + DIRECTORY_PATH),
+                await c.post(SELLER + DIRECTORY_PATH),
+            )
+
+    get, head, post = w.run(fetch())
+    assert get.status_code == 200 and get.headers["content-type"] == DIRECTORY_MEDIA_TYPE
+    now = system_clock()
+    # A verifier fetches the identity's own URL, on 443, whatever port the server listens on.
+    directory = verify_directory(w.fetched_from(get, now), SELLER_ORIGIN, now)
+    assert list(directory.keys) == [w.seller_key().thumbprint]
+    assert head.status_code == 200 and head.content == b""
+    assert post.status_code == 405
+
+
+def test_unsigned_request_is_refused_with_accept_signature(network: LateRouter) -> None:
+    async def send() -> httpx.Response:
+        async with httpx.AsyncClient(transport=network) as c:
+            return await c.post(SELLER + COMMIT_PATH, json=COMMIT)
+
+    response = w.run(send())
+    assert response.status_code == 403
+    assert response.json()["error"] == "signature-missing"
+    assert response.headers["accept-signature"] == accept_signature(has_body=True)
+
+
+def test_refusal_statuses_pass_through(network: LateRouter) -> None:
+    async def replay() -> tuple[httpx.Response, httpx.Response]:
+        async with client(network) as c:
+            first = await c.post(SELLER + COMMIT_PATH, json=COMMIT)
+        sent = sent_request(first)
+        assert sent is not None
+        # Resend the same signed bytes on a plain client, which doesn't sign again.
+        async with httpx.AsyncClient(transport=network) as plain:
+            again = await plain.post(sent.url, headers=sent.headers.items(), content=sent.body)
+        return first, again
+
+    first, again = w.run(replay())
+    assert first.status_code == 200
+    assert again.status_code == 429 and again.json()["error"] == "nonce-replayed"
+    assert again.headers["accept-signature"] == accept_signature(has_body=True)
+    assert "retry-after" not in again.headers
+
+
+def test_a_nonce_store_outage_is_503_with_retry_after(buyer_key: Ed25519Key) -> None:
+    class Down:
+        async def check_and_record(self, origin: Origin, nonce: str, ttl: Seconds) -> bool:
+            raise NonceStoreUnavailable("the store is down")
+
+    verifier = RequestVerifier(
+        StaticKeyResolver({BUYER: [buyer_key]}),
+        identity=SELLER_IDENTITY,
+        nonces=Down(),
+        keys=CONFORMANCE_KEYS,
+    )
+    app = RequireSignatureMiddleware(FastAPI(), w.seller_edge(verifier))
+    signed = w.signed_commit(buyer_key, now=system_clock())
+
+    async def send() -> httpx.Response:
+        async with httpx.AsyncClient(transport=httpx.ASGITransport(app=app)) as c:
+            return await c.post(
+                signed.url, headers=list(signed.headers.items()), content=signed.body
+            )
+
+    response = w.run(send())
+    assert response.status_code == 503
+    assert response.json()["error"] == "nonce-store-unavailable"
+    assert response.headers["retry-after"] == "1"
+    assert "accept-signature" not in response.headers
+
+
+def test_paths_outside_the_prefixes_need_no_signature(network: LateRouter) -> None:
+    async def get() -> httpx.Response:
+        async with httpx.AsyncClient(transport=network) as c:
+            return await c.get(SELLER + "/health")
+
+    response = w.run(get())
+    assert response.status_code == 200
+    assert "signature-input" in response.headers  # the response is still signed, without a binding
+
+
+def test_optional_mode_passes_unsigned_requests_without_identity() -> None:
+    late = LateRouter()
+    late.router = Router(
+        {
+            "seller.example.com": seller_app(late, on_unsigned="pass"),
+            "buyer.example.com": buyer_app(),
+        }
+    )
+
+    async def send() -> httpx.Response:
+        async with httpx.AsyncClient(transport=late) as c:
+            return await c.post(SELLER + COMMIT_PATH, json=COMMIT)
+
+    response = w.run(send())
+    assert response.status_code == 200 and response.json()["signed_by"] is None
+
+
+@pytest.mark.parametrize("strict", [True, False], ids=["required", "optional"])
+def test_streaming_responses_pass_through_unsigned(network: LateRouter, strict: bool) -> None:
+    async def stream() -> httpx.Response:
+        async with client(network, require_signed_response=strict) as c:
+            return await c.get(SELLER + "/proposals/prop_7/events")
+
+    response = w.run(stream())
+    assert response.status_code == 200 and response.content == b"data: 1\n\n"
+    assert "signature" not in response.headers
+    assert verified_response(response) is None
+    assert isinstance(verification(response), Unsigned)
+
+
+def not_verified(call: Callable[[], Awaitable[httpx.Response]]) -> ResponseNotVerified:
+    """The :class:`ResponseNotVerified` that ``call`` raises."""
+    with pytest.raises(ResponseNotVerified) as e:
+        w.run(call())
+    return e.value
+
+
+def failure(found: object, reason: Refusal) -> None:
+    """Asserts that ``found`` is a failed verification for ``reason``."""
+    assert isinstance(found, VerificationFailed) and found.reason is reason, found
+
+
+def test_an_unsigned_success_is_refused_when_required_and_carries_the_answer() -> None:
+    def answer(request: httpx.Request) -> httpx.Response:
+        return httpx.Response(200, json={"status": "committed"})
+
+    async def post(**options: Unpack[AuthOptions]) -> httpx.Response:
+        auth = WebBotAuth(
+            RequestSigner.of(w.buyer_key(), BUYER),
+            ResponseVerifier(StaticKeyResolver({}), keys=CONFORMANCE_KEYS),
+            **options,
+        )
+        async with auth.async_client(transport=httpx.MockTransport(answer)) as c:
+            return await c.post(SELLER + COMMIT_PATH, json=COMMIT)
+
+    refused = not_verified(post)
+    assert isinstance(refused.verification, Unsigned)
+    assert refused.response.json() == {"status": "committed"}
+    optional = w.run(post(require_signed_response=False))
+    assert optional.json() == {"status": "committed"}
+    assert isinstance(verification(optional), Unsigned)
+
+
+def test_a_valid_response_signed_by_another_origin_is_an_origin_mismatch(
+    other_key: Ed25519Key,
+) -> None:
+    """Another identity answers for seller.example.com with a valid, bound signature."""
+    now = system_clock()
+    impostor = ResponseSigner.of(other_key, w.OTHER)
+
+    def answer(request: httpx.Request) -> httpx.Response:
+        incoming = HTTPRequest(
+            request.method, str(request.url), request.headers.multi_items(), request.content
+        )
+        body = b'{"ok":true}'
+        signed = impostor.sign(HTTPResponse(200, w.JSON, body, incoming))
+        return httpx.Response(200, headers=signed.headers.items(), content=body)
+
+    directories = directory_transport(
+        {w.OTHER_ORIGIN: w.signed_directory(w.OTHER, [other_key], now)}
+    )
+
+    def auth(**options: Unpack[AuthOptions]) -> WebBotAuth:
+        resolver = DirectoryResolver(HttpxDirectoryFetcher(transport=directories))
+        signer = RequestSigner.of(w.buyer_key(), BUYER)
+        return WebBotAuth(signer, ResponseVerifier(resolver, keys=CONFORMANCE_KEYS), **options)
+
+    def send(auth: WebBotAuth) -> Callable[[], Awaitable[httpx.Response]]:
+        async def post() -> httpx.Response:
+            async with auth.async_client(transport=httpx.MockTransport(answer)) as c:
+                return await c.post(SELLER + COMMIT_PATH, json=COMMIT)
+
+        return post
+
+    failure(not_verified(send(auth())).verification, Refusal.ORIGIN_MISMATCH)
+    # Accepting unsigned responses accepts no failed verification.
+    optional = w.run(send(auth(require_signed_response=False))())
+    assert verified_response(optional) is None
+    failure(verification(optional), Refusal.ORIGIN_MISMATCH)
+    # The same response verifies when any identity may answer.
+    verified = verified_response(w.run(send(auth(expect=None))()))
+    assert verified is not None
+    assert str(verified.origin) == w.OTHER
+
+
+# ── the sync client ───────────────────────────────────────────────────────
+
+
+def test_sync_client_signs_and_verifies(buyer_key: Ed25519Key, seller_key: Ed25519Key) -> None:
+    sellers_resolver = DirectoryResolver(
+        HttpxDirectoryFetcher(
+            transport=directory_transport(
+                {BUYER_ORIGIN: w.signed_directory(BUYER, [buyer_key], now=system_clock())}
+            )
+        )
+    )
+    verifier = RequestVerifier(
+        sellers_resolver,
+        identity=SELLER_IDENTITY,
+        nonces=MemoryNonceStore(),
+        keys=CONFORMANCE_KEYS,
+    )
+    signer = ResponseSigner.of(seller_key, SELLER)
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        assert request.headers["accept-encoding"] == "identity"
+        incoming = HTTPRequest(
+            request.method, str(request.url), request.headers.multi_items(), request.content
+        )
+        verified = sync.verify(incoming)
+        body = json.dumps({"by": str(verified.origin)}).encode()
+        headers = {**JSON, **w.response_added(signer, 200, JSON, body, incoming)}
+        return httpx.Response(200, headers=headers, content=body)
+
+    seller_dir = directory_transport(
+        {SELLER_ORIGIN: w.signed_directory(SELLER, [seller_key], now=system_clock())}
+    )
+    buyers = DirectoryResolver(HttpxDirectoryFetcher(transport=seller_dir))
+    with SyncRuntime(buyers) as runtime, SyncRuntime(sellers_resolver) as sellers:
+        sync = SyncRequestVerifier(verifier, runtime=sellers)
+        auth = WebBotAuth(
+            RequestSigner.of(buyer_key, BUYER),
+            ResponseVerifier(buyers, keys=CONFORMANCE_KEYS),
+            runtime=runtime,
+        )
+        with auth.client(transport=httpx.MockTransport(handler)) as c:
+            response = c.post(SELLER + COMMIT_PATH, json=COMMIT)
+    assert response.json() == {"by": BUYER}
+    verified = verified_response(response)
+    assert verified is not None
+    assert verified.bound
+
+
+def test_sign_only_auth_leaves_responses_alone(buyer_key: Ed25519Key) -> None:
+    seen: dict[str, str] = {}
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        seen.update(request.headers)
+        return httpx.Response(200, json={})
+
+    auth = WebBotAuth(RequestSigner.of(buyer_key, BUYER))
+    with auth.client(transport=httpx.MockTransport(handler)) as c:
+        response = c.get(SELLER + "/proposals")
+    assert "signature-input" in seen and seen["accept-encoding"] != "identity"
+    assert verified_response(response) is None
+
+
+# ── helpers ───────────────────────────────────────────────────────────────
+
+
+def test_request_url_rebuilds_the_target() -> None:
+    scope: Scope = {
+        "scheme": "http",
+        "path": "/a b",
+        "raw_path": b"/a%20b",
+        "query_string": b"x=1",
+        "headers": [(b"host", b"seller.example.com:8080")],
+    }
+
+    # The Host header is the client's claim; the server's own base URL wins.
+    def on(base_url: str) -> ServerIdentity:
+        return ServerIdentity.from_config(base_url)
+
+    assert request_url(on("https://seller.example.com"), scope) == (
+        "https://seller.example.com/a%20b?x=1"
+    )
+    assert w.seller_edge().request_url(scope) == request_url(SELLER_IDENTITY, scope)
+    assert request_url(on("https://seller.example.com/"), {"path": "/"}) == (
+        "https://seller.example.com/"
+    )
+    assert request_url(on("http://127.0.0.1"), {"path": "/"}) == "http://127.0.0.1/"
+    port = on("https://seller.example.com:8443")
+    assert request_url(port, {"path": "/"}) == "https://seller.example.com:8443/"
+    assert str(port.origin) == "https://seller.example.com"
+    assert port.request_authority == "seller.example.com:8443"
+
+
+@pytest.mark.parametrize(
+    ("scope", "url"),
+    [
+        ({"raw_path": b"/p", "query_string": b"ids[]=1&f=a|b"}, f"{SELLER}/p?ids[]=1&f=a|b"),
+        ({"raw_path": b"/caf\xc3\xa9", "query_string": b"q=\xe9"}, f"{SELLER}/caf%C3%A9?q=%E9"),
+        ({"raw_path": b"/x/../p%zz", "query_string": b"a?b"}, f"{SELLER}/p%zz?a?b"),
+        ({"path": "/a b?c#d"}, f"{SELLER}/a%20b%3Fc%23d"),
+        ({"raw_path": b"*"}, f"{SELLER}/*"),
+    ],
+    ids=["raw-characters", "non-ascii-bytes", "dots-and-escapes", "decoded-path", "asterisk"],
+)
+def test_request_url_reads_the_bytes_the_client_sent(scope: Scope, url: str) -> None:
+    assert request_url(SELLER_IDENTITY, scope) == url
+
+
+def test_a_server_that_only_verifies_rebuilds_the_url_from_its_identity_alone() -> None:
+    verifier = RequestVerifier(
+        StaticKeyResolver({BUYER_ORIGIN: [w.buyer_key()]}),
+        identity=SELLER_IDENTITY,
+        nonces=MemoryNonceStore(),
+        keys=CONFORMANCE_KEYS,
+    )
+
+    async def app(scope: Scope, receive: Receive, send: Send) -> None:
+        # No ServerEdge, signer, or key: the identity is all the rebuild needs.
+        url = request_url(SELLER_IDENTITY, scope)
+        lines = scope["headers"]
+        assert isinstance(lines, list)
+        headers = [(k.decode("latin-1"), v.decode("latin-1")) for k, v in lines]
+        try:
+            verified = await verifier.verify(HTTPRequest(str(scope["method"]), url, headers))
+            status, body = 200, str(verified.origin).encode()
+        except WebBotAuthError as e:
+            status, body = e.status, e.reason.encode()
+        await send({"type": "http.response.start", "status": status, "headers": []})
+        await send({"type": "http.response.body", "body": body})
+
+    auth = WebBotAuth(RequestSigner.of(w.buyer_key(), BUYER))
+
+    async def get(path: str) -> httpx.Response:
+        async with auth.async_client(transport=httpx.ASGITransport(app=app)) as c:
+            return await c.get(SELLER + path)
+
+    for path in ("/proposals/a%20b", "/proposals/a b", "/proposals?ids[]=1&f=a|b"):
+        response = w.run(get(path))
+        assert (response.status_code, response.text) == (200, BUYER), path
+
+
+@pytest.mark.parametrize(
+    "base_url",
+    [
+        "seller.example.com",
+        "https://seller.example.com/api",
+        "https://",
+        "https://seller.example.com:443",
+        "http://seller.example.com:80",
+        "https://seller.example.com:08443",
+        "https://Seller.example.com",
+        "HTTPS://seller.example.com",
+        "https://user@seller.example.com",
+        "https://seller.example.com?x=1",
+        "https://seller.example.com#f",
+        "ftp://seller.example.com",
+    ],
+)
+def test_base_url_must_be_an_origin(base_url: str) -> None:
+    with pytest.raises(ConfigurationError):
+        ServerIdentity.from_config(base_url)
+
+
+def test_the_asgi_helpers_take_a_server_identity_not_a_string() -> None:
+    with pytest.raises(ConfigurationError):
+        DirectoryMiddleware(FastAPI(), [w.seller_key()])  # type: ignore[arg-type]
+    with pytest.raises(ConfigurationError):
+        DirectoryPublisher(SELLER, [w.seller_key()])  # type: ignore[arg-type]
+
+
+def test_the_response_signer_must_sign_as_the_servers_identity() -> None:
+    with pytest.raises(ConfigurationError):
+        ServerEdge(
+            SELLER_IDENTITY,
+            signer=ResponseSigner.of(w.seller_key(), w.OTHER),
+            publisher=DirectoryPublisher(w.OTHER_ORIGIN, [w.seller_key()]),
+        )
+
+
+def test_the_middlewares_take_the_servers_edge() -> None:
+    verifier = RequestVerifier(
+        StaticKeyResolver({BUYER: [w.buyer_key()]}),
+        identity=SELLER_IDENTITY,
+        nonces=MemoryNonceStore(),
+        keys=CONFORMANCE_KEYS,
+    )
+    with pytest.raises(ConfigurationError):
+        ResponseSigningMiddleware(FastAPI(), ResponseSigner.of(w.seller_key(), SELLER))  # type: ignore[arg-type]
+    with pytest.raises(ConfigurationError):
+        RequireSignatureMiddleware(FastAPI(), verifier)  # type: ignore[arg-type]
+
+
+@pytest.mark.parametrize(
+    "base_url",
+    [
+        "https://seller.example.com",
+        "http://seller.example.com:8443",
+        "https://seller.example.com:9443",
+    ],
+)
+def test_an_edge_refuses_a_confirmer_on_another_base_url(base_url: str) -> None:
+    verifier = RequestVerifier(
+        StaticKeyResolver({BUYER: [w.buyer_key()]}),
+        identity=ServerIdentity.from_config(base_url),
+        nonces=MemoryNonceStore(),
+        keys=CONFORMANCE_KEYS,
+    )
+    with pytest.raises(ConfigurationError, match="base URL is https://seller.example.com:8443"):
+        w.seller_edge(verifier, identity=PORTED)
+
+
+@pytest.mark.parametrize(
+    ("verifies_for", "status"), [(SELLER_IDENTITY, 200), (PORTED, 403)], ids=["same", "other"]
+)
+def test_a_boundary_verifier_on_another_base_url_refuses_the_request(
+    verifies_for: ServerIdentity, status: int
+) -> None:
+    """The application verifies at its own boundary, on the URL its edge rebuilds."""
+    edge = w.seller_edge()
+    verifier = RequestVerifier(
+        StaticKeyResolver({BUYER: [w.buyer_key()]}),
+        identity=verifies_for,
+        nonces=MemoryNonceStore(),
+        keys=CONFORMANCE_KEYS,
+    )
+    api = FastAPI()
+
+    @api.post(COMMIT_PATH)
+    async def commit(request: Request) -> Response:
+        body = await request.body()
+        received = HTTPRequest(
+            request.method, edge.request_url(request.scope), request.headers.items(), body
+        )
+        try:
+            await verifier.verify(received)
+        except WebBotAuthError as e:
+            refused = refusal_response(e, has_body=bool(body))
+            return Response(refused.body, refused.status, dict(refused.headers.items()))
+        return JSONResponse({"ok": True})
+
+    auth = WebBotAuth(
+        RequestSigner.of(w.buyer_key(), BUYER),
+        ResponseVerifier(StaticKeyResolver({SELLER: [w.seller_key()]}), keys=CONFORMANCE_KEYS),
+    )
+
+    async def post() -> httpx.Response:
+        transport = httpx.ASGITransport(app=ResponseSigningMiddleware(api, edge))
+        async with auth.async_client(transport=transport) as c:
+            return await c.post(SELLER + COMMIT_PATH, json=COMMIT)
+
+    response = w.run(post())
+    assert response.status_code == status
+    if status == 200:
+        assert verified_response(response) is not None  # the response binds to the request
+    else:
+        assert response.json()["error"] == "authority"
+
+
+def test_the_directory_is_signed_for_the_configured_authority_whatever_the_host() -> None:
+    app = DirectoryMiddleware(
+        FastAPI(), DirectoryPublisher(SELLER_IDENTITY.origin, [w.seller_key()])
+    )
+
+    async def fetch() -> httpx.Response:
+        async with httpx.AsyncClient(transport=httpx.ASGITransport(app=app)) as c:
+            return await c.get("https://evil.example.com" + DIRECTORY_PATH)
+
+    response = w.run(fetch())
+    now = system_clock()
+    fetched = w.fetched_from(response, now)
+    rehosted = replace(fetched, url=SELLER_ORIGIN.directory_url)
+    assert verify_directory(rehosted, SELLER_ORIGIN, now).origin == SELLER_ORIGIN
+    # Served again from another domain, its signatures name the seller's authority.
+    evil = Origin.parse("https://evil.example.com")
+    expect_refusal(lambda: verify_directory(fetched, evil, now), Refusal.DIRECTORY_SIGNATURE)
+
+
+def test_a_request_signed_for_another_server_is_refused(network: LateRouter) -> None:
+    """The buyer's request to seller.example.com, forwarded to another server with its Host."""
+    seller_b = ServerIdentity.from_config("https://seller-b.example.com")
+    verifier = RequestVerifier(
+        DirectoryResolver(HttpxDirectoryFetcher(transport=network)),
+        identity=seller_b,
+        nonces=MemoryNonceStore(),
+        keys=CONFORMANCE_KEYS,
+    )
+    app = RequireSignatureMiddleware(FastAPI(), w.seller_edge(verifier))
+
+    async def forward() -> httpx.Response:
+        added = w.request_added(
+            RequestSigner.of(w.buyer_key(), BUYER),
+            "POST",
+            SELLER + COMMIT_PATH,
+            {"Content-Type": "application/json"},
+            json.dumps(COMMIT).encode(),
+        )
+        async with httpx.AsyncClient(transport=httpx.ASGITransport(app=app)) as c:
+            return await c.post(
+                SELLER + COMMIT_PATH,  # Host: seller.example.com
+                content=json.dumps(COMMIT).encode(),
+                headers={"Content-Type": "application/json", **added},
+            )
+
+    response = w.run(forward())
+    assert response.status_code == 403 and response.json()["error"] == "signature-invalid"
+
+
+def test_the_verifier_refuses_a_url_for_another_authority(buyer_key: Ed25519Key) -> None:
+    request = w.signed_commit(buyer_key)
+    verifier = RequestVerifier(
+        w.directory_resolver({BUYER: [buyer_key]}),
+        nonces=MemoryNonceStore(clock=lambda: T0),
+        clock=lambda: T0,
+        identity=ServerIdentity.from_config("https://seller-b.example.com"),
+        keys=CONFORMANCE_KEYS,
+    )
+    expect_refusal(lambda: w.verify(verifier, request), Refusal.AUTHORITY)
+    allowed = RequestVerifier(
+        w.directory_resolver({BUYER: [buyer_key]}),
+        nonces=MemoryNonceStore(clock=lambda: T0),
+        clock=lambda: T0,
+        identity=ServerIdentity.from_config("https://seller.example.com"),
+        keys=CONFORMANCE_KEYS,
+    )
+    assert w.verify(allowed, request).origin == BUYER_ORIGIN
+
+
+def test_a_framework_route_answers_with_the_publisher() -> None:
+    publisher = DirectoryPublisher(SELLER_ORIGIN, [w.seller_key()])
+    status, headers, body = w.run(publisher.answer(T0))
+    assert status == 200 and json.loads(body)["keys"][0]["kid"] == w.seller_key().thumbprint
+    assert "Signature" in headers
+
+
+def test_a_response_the_profile_cannot_sign_is_refused_loudly(
+    caplog: pytest.LogCaptureFixture,
+) -> None:
+    async def app(scope: Scope, receive: Receive, send: Send) -> None:
+        await send({"type": "http.response.start", "status": 200, "headers": []})
+        await send({"type": "http.response.body", "body": b"raw"})
+
+    wrapped = w.seller_signing(app)
+
+    async def send() -> httpx.Response:
+        async with httpx.AsyncClient(transport=httpx.ASGITransport(app=wrapped)) as c:
+            return await c.get("https://seller.example.com/x")
+
+    response = w.run(send())
+    assert response.status_code == 500 and response.json()["error"] == "response-unsignable"
+    assert "cannot sign the response" in caplog.text
+
+
+def test_a_refusal_to_an_incomplete_signature_is_signed_unbound(network: LateRouter) -> None:
+    """Signature-Input tagged web-bot-auth, but no Signature: a 403, signed, not a 500."""
+    request = w.signed_commit(w.buyer_key(), origin=BUYER)
+    headers = {k: v for k, v in request.headers if k != "Signature"}
+
+    async def send() -> httpx.Response:
+        async with httpx.AsyncClient(transport=network) as c:
+            return await c.post(SELLER + COMMIT_PATH, content=request.body, headers=headers)
+
+    response = w.run(send())
+    assert response.status_code == 403 and response.json()["error"] == "signature-missing"
+    assert '"signature";req' not in response.headers["signature-input"]
+    assert "accept-signature" in response.headers
+
+
+# ── a live key source for the directory ───────────────────────────────────
+
+
+async def _directory(app: ASGIApp) -> httpx.Response:
+    async with httpx.AsyncClient(transport=httpx.ASGITransport(app=app)) as c:
+        return await c.get(SELLER + DIRECTORY_PATH)
+
+
+def _kids(response: httpx.Response) -> list[str]:
+    return [k["kid"] for k in json.loads(response.content)["keys"]]
+
+
+@pytest.mark.parametrize("asynchronous", [False, True])
+def test_directory_reads_a_key_source_on_every_request(asynchronous: bool) -> None:
+    first, second = w.seller_key(), w.other_key()
+    current = [first]
+
+    def sync_source() -> list[Ed25519Key]:
+        return list(current)
+
+    async def async_source() -> list[Ed25519Key]:
+        return list(current)
+
+    app = DirectoryMiddleware(
+        FastAPI(),
+        DirectoryPublisher(SELLER_IDENTITY.origin, async_source if asynchronous else sync_source),
+    )
+    assert _kids(w.run(_directory(app))) == [first.thumbprint]
+    current.append(second)  # rotation: publish the new key next to the old one
+    response = w.run(_directory(app))
+    assert _kids(response) == [first.thumbprint, second.thumbprint]
+    now = system_clock()
+    directory = verify_directory(w.fetched_from(response, now), SELLER_ORIGIN, now)
+    assert set(directory.keys) == {first.thumbprint, second.thumbprint}
+    current.remove(first)
+    assert _kids(w.run(_directory(app))) == [second.thumbprint]
+    current.clear()
+    assert w.run(_directory(app)).status_code == 503
+
+
+def test_directory_still_takes_a_list() -> None:
+    with pytest.raises(ConfigurationError):
+        DirectoryPublisher(SELLER_IDENTITY.origin, [])
+    assert _kids(
+        w.run(
+            _directory(
+                DirectoryMiddleware(
+                    FastAPI(), DirectoryPublisher(SELLER_IDENTITY.origin, [w.seller_key()])
+                )
+            )
+        )
+    ) == [w.seller_key().thumbprint]
+
+
+# ── verify-only: an unsigned request, a signed response ───────────────────
+
+
+def _bearer_seller(seller_key: Ed25519Key, *, origin: str = SELLER) -> httpx.MockTransport:
+    signer = ResponseSigner.of(seller_key, origin)
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        assert "signature" not in request.headers and "signature-agent" not in request.headers
+        assert request.headers["authorization"] == "Bearer t0k3n"
+        body = b'{"ok":true}'
+        incoming = HTTPRequest(
+            request.method, str(request.url), request.headers.multi_items(), request.content
+        )
+        headers = {**JSON, **w.response_added(signer, 200, JSON, body, incoming)}
+        return httpx.Response(200, headers=headers, content=body)
+
+    return httpx.MockTransport(handler)
+
+
+def _seller_directory(seller_key: Ed25519Key) -> DirectoryResolver:
+    now = system_clock()
+    return DirectoryResolver(
+        HttpxDirectoryFetcher(
+            transport=directory_transport(
+                {SELLER_ORIGIN: w.signed_directory(SELLER, [seller_key], now=now)}
+            )
+        )
+    )
+
+
+def test_verify_only_leaves_the_request_unsigned_and_verifies_the_response(
+    seller_key: Ed25519Key,
+) -> None:
+    resolver = _seller_directory(seller_key)
+    headers = {"Authorization": "Bearer t0k3n"}
+    with SyncRuntime(resolver) as runtime:
+        auth = WebBotAuth.verify_only(
+            ResponseVerifier(resolver, keys=CONFORMANCE_KEYS), runtime=runtime
+        )
+        with auth.client(transport=_bearer_seller(seller_key), headers=headers) as c:
+            response = c.post(SELLER + COMMIT_PATH, json=COMMIT)
+    verified = verified_response(response)
+    assert verified is not None
+    assert verified.origin == SELLER_ORIGIN and verified.bound is False and verified.body_covered
+
+
+def test_verify_only_works_with_the_async_client(seller_key: Ed25519Key) -> None:
+    auth = WebBotAuth.verify_only(
+        ResponseVerifier(_seller_directory(seller_key), keys=CONFORMANCE_KEYS)
+    )
+
+    async def send() -> httpx.Response:
+        async with auth.async_client(
+            transport=_bearer_seller(seller_key), headers={"Authorization": "Bearer t0k3n"}
+        ) as c:
+            return await c.get(SELLER + "/proposals/prop_7")
+
+    verified = verified_response(w.run(send()))
+    assert verified is not None
+    assert verified.origin == SELLER_ORIGIN
+
+
+def test_verify_only_checks_the_expected_origin(seller_key: Ed25519Key) -> None:
+    resolver = _seller_directory(seller_key)
+    headers = {"Authorization": "Bearer t0k3n"}
+    with SyncRuntime(resolver) as runtime:
+        verifier = ResponseVerifier(resolver, keys=CONFORMANCE_KEYS)
+        auth = WebBotAuth.verify_only(verifier, runtime=runtime, expect=w.OTHER_ORIGIN)
+        with auth.client(transport=_bearer_seller(seller_key), headers=headers) as c:
+            with pytest.raises(ResponseNotVerified) as e:
+                c.get(SELLER + "/proposals/prop_7")
+    failure(e.value.verification, Refusal.ORIGIN_MISMATCH)
+    assert e.value.response.json() == {"ok": True}
+
+
+def test_verify_only_refuses_an_unsigned_response(seller_key: Ed25519Key) -> None:
+    resolver = _seller_directory(seller_key)
+    transport = httpx.MockTransport(lambda request: httpx.Response(200, json={}))
+    with SyncRuntime(resolver) as runtime:
+        auth = WebBotAuth.verify_only(
+            ResponseVerifier(resolver, keys=CONFORMANCE_KEYS), runtime=runtime
+        )
+        with auth.client(transport=transport) as c:
+            with pytest.raises(ResponseNotVerified) as e:
+                c.get(SELLER + "/proposals/prop_7")
+    assert isinstance(e.value.verification, Unsigned) and e.value.response.json() == {}
+
+
+def test_an_auth_must_sign_or_verify() -> None:
+    with pytest.raises(ValueError):
+        WebBotAuth(None)
+
+
+def test_directory_middleware_and_publishing_take_max_age() -> None:
+    zero = PublishPolicy(max_age=0)
+    _, headers, _ = publish_directory(SELLER_ORIGIN, [w.seller_key()], now=T0, policy=zero)
+    assert headers["Cache-Control"] == "max-age=0"
+    publish = PublishPolicy(max_age=60)
+    app = DirectoryMiddleware(
+        FastAPI(), DirectoryPublisher(SELLER_IDENTITY.origin, [w.seller_key()], policy=publish)
+    )
+    assert w.run(_directory(app)).headers["cache-control"] == "max-age=60"
+    with pytest.raises(ConfigurationError):
+        PublishPolicy(max_age=-5)
diff --git a/tests/web_bot_auth/test_wba_interop.py b/tests/web_bot_auth/test_wba_interop.py
new file mode 100644
index 0000000..a7c6602
--- /dev/null
+++ b/tests/web_bot_auth/test_wba_interop.py
@@ -0,0 +1,202 @@
+"""Interop with Cloudflare's web-bot-auth 0.2.0, through the Node harness in interop/.
+
+The harness runs this library as an adapter (``conformance adapter --lines``)
+and grades every message three ways: the Python verdict, Cloudflare's library
+with the profile's rules (policy.mjs), and Cloudflare's library as shipped.
+The tests carry the ``interop`` marker, which pytest deselects by default:
+``make interop`` installs the harness's Node dependencies and runs them. Once
+selected, they fail, rather than skip, when ``node`` or those dependencies are
+absent.
+"""
+
+from __future__ import annotations
+
+import json
+import shutil
+import subprocess
+import sys
+from pathlib import Path
+from typing import NotRequired, TypedDict
+
+import pytest
+
+from iab_agentic_primitives.web_bot_auth.conformance import VECTORS
+
+pytestmark = pytest.mark.interop
+
+INTEROP = Path(__file__).parent / "interop"
+NODE = shutil.which("node")
+
+_MISSING = (
+    "node is not installed"
+    if NODE is None
+    else None
+    if (INTEROP / "node_modules" / "web-bot-auth").is_dir()
+    else "the harness's Node dependencies are not installed: run `make interop-deps`"
+)
+
+
+class Check(TypedDict):
+    """One row of the harness's ``--json`` report."""
+
+    suite: str
+    id: str
+    ok: bool
+    expected: str
+    detail: str
+    tier: NotRequired[str | None]
+    python: NotRequired[str | None]
+    cloudflare: NotRequired[str | None]
+    cloudflare_bare: NotRequired[str | None]
+
+
+@pytest.fixture(autouse=True, scope="module")
+def _harness_installed() -> None:
+    if _MISSING is not None:
+        pytest.fail(f"the interop harness can't run: {_MISSING}", pytrace=False)
+
+
+def _harness(tmp_path_factory: pytest.TempPathFactory, *args: str) -> list[Check]:
+    assert NODE is not None
+    out = tmp_path_factory.mktemp("interop") / "checks.json"
+    done = subprocess.run(
+        [NODE, str(INTEROP / "run.mjs"), "--vectors", str(VECTORS), "--json", str(out), *args],
+        capture_output=True,
+        text=True,
+        timeout=600,
+        check=False,
+    )
+    assert out.exists(), done.stdout + done.stderr
+    checks: list[Check] = json.loads(out.read_text())["checks"]
+    return checks
+
+
+@pytest.fixture(scope="module")
+def checks(tmp_path_factory: pytest.TempPathFactory) -> list[Check]:
+    adapter = (
+        f'"{sys.executable}" -m iab_agentic_primitives.web_bot_auth.conformance adapter --lines'
+    )
+    return _harness(tmp_path_factory, "--persistent", "--adapter", adapter)
+
+
+@pytest.fixture(scope="module")
+def judge_checks(tmp_path_factory: pytest.TempPathFactory) -> list[Check]:
+    return _harness(tmp_path_factory, "--self")
+
+
+def _failures(checks: list[Check]) -> list[str]:
+    return [
+        f"{c['suite']} {c['id']}: expected {c['expected']}, {c['detail']}"
+        for c in checks
+        if not c["ok"]
+    ]
+
+
+def _pick(checks: list[Check], *prefixes: str) -> list[Check]:
+    found = [c for c in checks if c["id"].startswith(prefixes)]
+    assert found, prefixes
+    return found
+
+
+def test_every_check_passes(checks: list[Check]) -> None:
+    assert _failures(checks) == []
+
+
+def test_the_judge_passes_its_own_tier_check(judge_checks: list[Check]) -> None:
+    assert _failures(judge_checks) == []
+
+
+def test_python_signed_requests_verify_in_cloudflare(checks: list[Check]) -> None:
+    for c in _pick(
+        checks, "Python signs POST, Cloudflare verifies", "Python signs GET, Cloudflare verifies"
+    ):
+        assert (c["cloudflare"], c["cloudflare_bare"]) == ("pass", "pass"), c
+
+
+def test_cloudflare_signed_requests_verify_in_python_in_both_forms(checks: list[Check]) -> None:
+    for method in ("POST", "GET"):
+        for form in ("the key URL", "the bare origin"):
+            (c,) = _pick(checks, f"Cloudflare signs {method} with {form}, Python verifies")
+            assert (c["python"], c["cloudflare"], c["cloudflare_bare"]) == (
+                "pass",
+                "pass",
+                "pass",
+            ), c
+        (replay,) = _pick(checks, f"Cloudflare signs {method}, Python verifies it twice")
+        assert replay["python"] == replay["cloudflare"] == "429 nonce-replayed"
+
+
+def test_tampered_copies_fail_in_both(checks: list[Check]) -> None:
+    tampered = [c for c in checks if "both refuse" in c["id"]]
+    assert len(tampered) >= 8
+    for c in tampered:
+        assert c["python"] != "pass" and c["cloudflare"] != "pass", c
+        if c["tier"] == "wba":
+            assert c["cloudflare_bare"] != "pass", c
+
+
+def test_directories_interoperate(checks: list[Check]) -> None:
+    signed = _pick(checks, "Python signs the directory, Cloudflare verifies")[0]
+    assert (signed["cloudflare"], signed["cloudflare_bare"]) == ("pass", "pass")
+    assert _pick(checks, "Cloudflare signs the directory, Python verifies")[0]["python"] == "pass"
+
+
+def test_the_authority_scenario_is_refused_by_both_for_its_rule(checks: list[Check]) -> None:
+    (c,) = _pick(checks, "R26 ")
+    assert (c["python"], c["cloudflare"], c["cloudflare_bare"]) == (
+        "403 authority",
+        "403 authority",
+        "pass",
+    )
+    assert c["tier"] == "profile"
+
+
+def test_responses_interoperate(checks: list[Check]) -> None:
+    assert _pick(checks, "Python signs a response, Cloudflare verifies")[0]["cloudflare"] == "pass"
+    assert _pick(checks, "Cloudflare signs a response, Python verifies")[0]["python"] == "pass"
+
+
+def test_every_vector_and_scenario_gets_the_same_verdict_and_rule_in_both(
+    checks: list[Check],
+) -> None:
+    graded = [c for c in checks if c["suite"] in ("vectors", "scenarios")]
+    assert len(graded) >= 60
+    for c in graded:
+        # A refusal's verdict is its status and rule, so the two agree rule by rule.
+        assert c["python"] == c["cloudflare"], c
+        if c["tier"] == "wba":
+            assert (c["cloudflare_bare"] == "pass") == (c["python"] == "pass"), c
+        else:
+            assert c["tier"] == "profile"
+            assert (c["cloudflare_bare"] == "pass") != (c["python"] == "pass"), c
+
+
+DOC = Path(__file__).resolve().parents[2] / "WEB_BOT_AUTH.md"
+
+
+def _doc_table() -> list[tuple[str, ...]]:
+    """The interop table in WEB_BOT_AUTH.md, one tuple of cells per check."""
+    text = DOC.read_text()
+    start = text.index("| Suite | Check | Tier |")
+    table = text[start : text.index("\n\n", start)]
+    rows = [line.strip("|").split(" | ") for line in table.strip().splitlines()[2:]]
+    return [tuple(cell.strip() for cell in row) for row in rows]
+
+
+def test_the_doc_table_is_the_harness_output(checks: list[Check]) -> None:
+    def cell(value: str | None) -> str:
+        return "-" if value is None else value
+
+    harness = [
+        (
+            c["suite"],
+            c["id"],
+            c.get("tier") or "-",
+            cell(c.get("python")),
+            cell(c.get("cloudflare")),
+            cell(c.get("cloudflare_bare")),
+        )
+        for c in checks
+    ]
+    assert _doc_table() == harness
+    assert f"All {len(checks)} checks pass." in DOC.read_text()
diff --git a/tests/web_bot_auth/test_wba_keyfile.py b/tests/web_bot_auth/test_wba_keyfile.py
new file mode 100644
index 0000000..0375d18
--- /dev/null
+++ b/tests/web_bot_auth/test_wba_keyfile.py
@@ -0,0 +1,98 @@
+"""load_or_create: one key file, written once and atomically, even on concurrent first boots,
+and read back only as the Ed25519 private key it holds."""
+
+from __future__ import annotations
+
+import json
+import multiprocessing
+import os
+import stat
+from pathlib import Path
+
+import pytest
+
+from iab_agentic_primitives.web_bot_auth import (
+    CONFORMANCE_KEYS,
+    MemoryNonceStore,
+    RequestSigner,
+    RequestVerifier,
+    StaticKeyResolver,
+)
+from iab_agentic_primitives.web_bot_auth.keyfile import load_or_create
+
+from . import support as w
+
+
+def test_load_or_create_writes_a_private_file_once(tmp_path: Path) -> None:
+    path = tmp_path / "keys" / "agent.jwk"
+    first = load_or_create(path)
+    assert stat.S_IMODE(os.stat(path).st_mode) == 0o600
+    assert json.loads(path.read_text())["kid"] == first.thumbprint
+    again = load_or_create(path)
+    assert again.thumbprint == first.thumbprint
+    assert [p.name for p in path.parent.iterdir()] == ["agent.jwk"]
+    # The key read back signs requests that verify under the key first published.
+    signed = RequestSigner.of(again, w.BUYER).sign(w.commit(), now=w.T0)
+    verifier = RequestVerifier(
+        StaticKeyResolver({w.BUYER: [first.public_jwk()]}),
+        identity=w.SELLER_IDENTITY,
+        nonces=MemoryNonceStore(clock=lambda: w.T0),
+        clock=lambda: w.T0,
+        keys=CONFORMANCE_KEYS,
+    )
+    assert w.run(verifier.verify(signed)).keyid == first.thumbprint
+
+
+def _mismatched() -> dict[str, object]:
+    jwk: dict[str, object] = dict(w.buyer_key().private_jwk())
+    jwk["x"] = w.other_key().public_jwk()["x"]
+    return jwk
+
+
+@pytest.mark.parametrize(
+    "jwk",
+    [
+        {"kty": "OKP", "crv": "Ed448", "d": "AA"},
+        {"kty": "EC", "crv": "P-256", "d": "AA"},
+        {"kty": "OKP", "crv": "Ed25519"},
+        _mismatched(),
+    ],
+    ids=["ed448", "p-256", "public-only", "x-of-another-key"],
+)
+def test_a_key_file_that_holds_anything_but_its_ed25519_private_key_is_refused(
+    tmp_path: Path, jwk: dict[str, str]
+) -> None:
+    path = tmp_path / "agent.jwk"
+    path.write_text(json.dumps(jwk))
+    with pytest.raises(ValueError, match="Ed25519|does not match"):
+        load_or_create(path)
+    assert json.loads(path.read_text()) == jwk  # never overwritten
+
+
+def _boot(
+    path: str,
+    barrier: multiprocessing.synchronize.Barrier,
+    out: multiprocessing.Queue[tuple[str, str]],
+) -> None:
+    barrier.wait()
+    try:
+        out.put(("ok", load_or_create(path).thumbprint))
+    except Exception as e:  # reported to the parent, which fails the test
+        out.put(("error", repr(e)))
+
+
+def test_eight_concurrent_first_boots_make_one_key(tmp_path: Path) -> None:
+    path = tmp_path / "fresh" / "wba-key.jwk"
+    context = multiprocessing.get_context("spawn")
+    barrier = context.Barrier(8)
+    out = context.Queue()
+    workers = [context.Process(target=_boot, args=(str(path), barrier, out)) for _ in range(8)]
+    for worker in workers:
+        worker.start()
+    results = [out.get(timeout=60) for _ in workers]
+    for worker in workers:
+        worker.join(timeout=60)
+    assert [status for status, _ in results] == ["ok"] * 8, results
+    assert len({kid for _, kid in results}) == 1
+    assert [p.name for p in path.parent.iterdir()] == ["wba-key.jwk"]
+    assert json.loads(path.read_text())["kid"] == results[0][1]
diff --git a/tests/web_bot_auth/test_wba_library_contract.py b/tests/web_bot_auth/test_wba_library_contract.py
new file mode 100644
index 0000000..39a6afb
--- /dev/null
+++ b/tests/web_bot_auth/test_wba_library_contract.py
@@ -0,0 +1,146 @@
+"""Contract tests for the library behavior the module builds on.
+
+The module keeps only the profile's rules and relies on these libraries for
+the rest: http-message-signatures (RFC 9421 and RFC 9530), http-sf (Structured
+Fields), joserfc (JWK thumbprints), and idna (host canonicalization). The
+library behaviors it depends on are pinned here, through the module's own
+signers and verifiers where it can, so an upgrade that changes one fails a
+test instead of changing a verdict.
+"""
+
+from __future__ import annotations
+
+import os
+import re
+import shutil
+import subprocess
+import sys
+import tomllib
+from pathlib import Path
+
+import http_sf
+import idna
+import pytest
+from http_message_signatures import ContentDigest
+from http_message_signatures.exceptions import InvalidSignature
+from joserfc.jwk import OKPKey
+
+from iab_agentic_primitives.web_bot_auth import DIRECTORY_PATH, EXTRA_MODULES, UnixSeconds
+from iab_agentic_primitives.web_bot_auth._unchecked import signature_base
+from iab_agentic_primitives.web_bot_auth.conformance.generate import VECTORS_REGISTRY
+
+from .support import SELLER, at, request_verifier, run, seller_key, sign_request, sign_response
+
+
+def test_the_window_is_left_to_the_profile() -> None:
+    # Signed and verified a million seconds before the wall clock: the library
+    # doesn't check the time, and the verifier's injected clock decides.
+    then = at(-(10**6))
+    signed = sign_request(now=then)
+    assert run(request_verifier(now=UnixSeconds(then + 5)).verify(signed)).expires == then + 300
+
+
+def test_req_and_key_component_parameters_resolve() -> None:
+    request = sign_request()
+    response = sign_response(request)
+    base = signature_base(response, "sig1", seller_key()).decode()
+    request_signature = (request.headers.get("signature") or "").split("=", 1)[1]
+    assert f'"signature";req;key="sig1": {request_signature}' in base
+    assert f'"signature-agent";key="sig1": "{SELLER}{DIRECTORY_PATH}"' in base
+
+
+def test_content_digest_is_rfc_9530_sha_256() -> None:
+    assert ContentDigest.create(b"") == "sha-256=:47DEQpj8HBSa+/TImW+5JCeuQeRkm5NMpJWZG3hSuFU=:"
+    ContentDigest.verify(ContentDigest.create(b"x"), b"x")
+    with pytest.raises(InvalidSignature):
+        ContentDigest.verify(ContentDigest.create(b"x"), b"y")
+
+
+def test_structured_fields_refuse_duplicates_on_request() -> None:
+    def refuse(key: str, context: str) -> None:
+        raise ValueError(key)
+
+    with pytest.raises(ValueError):
+        http_sf.parse(b"a=1, a=2", tltype="dictionary", on_duplicate_key=refuse)
+    members = http_sf.parse(b'a="x";type=directory', tltype="dictionary")
+    assert isinstance(members, dict)
+    member = members["a"]
+    assert isinstance(member, tuple) and member[0] == "x"
+    assert isinstance(member[1], dict) and isinstance(member[1]["type"], http_sf.Token)
+
+
+def test_joserfc_thumbprint_is_rfc_7638_for_okp() -> None:
+    x = "11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo"
+    jwk: dict[str, str | list[str]] = {"kty": "OKP", "crv": "Ed25519", "x": x}
+    assert (
+        OKPKey.import_key(jwk).thumbprint() == "kPrK_qmxVWaYVA9wwBF6Iuo3vVzz7TxHCTwXBygrS4k"
+    )  # gitleaks:allow
+
+
+def test_idna_2008_non_transitional() -> None:
+    assert idna.encode("straße.de", uts46=True, transitional=False) == b"xn--strae-oqa.de"
+    assert (
+        idna.encode("Seller.Example.COM", uts46=True, transitional=False) == b"seller.example.com"
+    )
+
+
+@pytest.mark.parametrize("host", ["xn--a.example", "xn--bcher-2pa.example"])
+def test_idna_refuses_invalid_a_labels(host: str) -> None:
+    with pytest.raises(idna.IDNAError):
+        idna.encode(host, uts46=True, transitional=False)
+    from iab_agentic_primitives.web_bot_auth.values import is_canonical_host
+
+    assert is_canonical_host(host) is False
+    assert is_canonical_host("xn--bcher-kva.example") is True
+
+
+RFC_8037_X = "11qYAYKxCrfVS_7TyWQHOg7hcvPapiMlrwIaaPcHURo"
+
+
+@pytest.mark.parametrize(
+    "x",
+    [
+        RFC_8037_X + "=",  # padded
+        RFC_8037_X.replace("_", "/").replace("-", "+"),  # standard alphabet
+        RFC_8037_X[:-1] + "p",  # a trailing bit altered
+    ],
+    ids=["padded", "standard-alphabet", "trailing-bit"],
+)
+def test_joserfc_refuses_a_non_canonical_x(x: str) -> None:
+    with pytest.raises(ValueError):
+        OKPKey.import_key({"kty": "OKP", "crv": "Ed25519", "x": x})
+    from iab_agentic_primitives.web_bot_auth import thumbprint
+
+    with pytest.raises(ValueError):
+        thumbprint({"kty": "OKP", "crv": "Ed25519", "x": x})
+
+
+# ── the module's boundary ─────────────────────────────────────────────────
+
+_ROOT = Path(__file__).resolve().parents[2]
+_PACKAGE = _ROOT / "src" / "iab_agentic_primitives" / "web_bot_auth"
+
+
+def test_the_extra_lists_the_libraries_pyproject_installs() -> None:
+    project = tomllib.loads((_ROOT / "pyproject.toml").read_text())["project"]
+    requirements = project["optional-dependencies"]["wba"]
+    names = sorted(re.split(r"[^A-Za-z0-9._-]", r, maxsplit=1)[0] for r in requirements)
+    assert tuple(name.replace("-", "_") for name in names) == EXTRA_MODULES
+
+
+def test_a_vendored_copy_imports_and_reads_its_own_vectors(tmp_path: Path) -> None:
+    shutil.copytree(_PACKAGE, tmp_path / "vendored", ignore=shutil.ignore_patterns("__pycache__"))
+    code = (
+        "import vendored.conformance as c, vendored.extra as e; "
+        "print(len(list(c.vectors())), len(e.EXTRA_MODULES))"
+    )
+    done = subprocess.run(
+        [sys.executable, "-c", code],
+        cwd=tmp_path,
+        env={**os.environ, "PYTHONPATH": str(tmp_path)},
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+    assert done.returncode == 0, done.stderr
+    assert done.stdout.split() == [str(len(VECTORS_REGISTRY)), str(len(EXTRA_MODULES))]
diff --git a/tests/web_bot_auth/test_wba_logging.py b/tests/web_bot_auth/test_wba_logging.py
new file mode 100644
index 0000000..8117536
--- /dev/null
+++ b/tests/web_bot_auth/test_wba_logging.py
@@ -0,0 +1,63 @@
+"""Log records: each refusal and each failed directory fetch, never a nonce or a body."""
+
+from __future__ import annotations
+
+import logging
+
+import httpx
+import pytest
+
+from iab_agentic_primitives.web_bot_auth import (
+    CONFORMANCE_KEYS,
+    DirectoryResolver,
+    MemoryNonceStore,
+    Refusal,
+    RequestVerifier,
+)
+from iab_agentic_primitives.web_bot_auth.fetcher import HttpxDirectoryFetcher
+from iab_agentic_primitives.web_bot_auth.testing import directory_transport
+
+from . import support as w
+from .support import at, expect_refusal
+
+
+def _verifier(transport: httpx.AsyncBaseTransport) -> RequestVerifier:
+    return RequestVerifier(
+        DirectoryResolver(HttpxDirectoryFetcher(transport=transport), clock=lambda: w.T0),
+        identity=w.SELLER_IDENTITY,
+        nonces=MemoryNonceStore(clock=lambda: w.T0),
+        clock=lambda: w.T0,
+        keys=CONFORMANCE_KEYS,
+    )
+
+
+def test_a_refusal_is_logged_with_its_status_reason_origin_and_keyid(
+    caplog: pytest.LogCaptureFixture,
+) -> None:
+    key = w.buyer_key()
+    verifier = _verifier(directory_transport({w.BUYER_ORIGIN: w.signed_directory(w.BUYER, [key])}))
+    document = w.signed_commit(key)
+    request = document
+    w.run(verifier.verify(request))
+    with caplog.at_level(logging.INFO, "iab_agentic_primitives.web_bot_auth"):
+        # the same nonce again
+        expect_refusal(lambda: verifier.verify(request), Refusal.NONCE_REPLAYED)
+    (record,) = [r for r in caplog.records if "refused" in r.getMessage()]
+    message = record.getMessage()
+    assert "429 nonce-replayed" in message and w.BUYER in message and key.thumbprint in message
+    nonce = (request.headers.get("signature-input") or "").split('nonce="')[1].split('"')[0]
+    assert nonce not in message and w.COMMIT_BODY.decode() not in message
+
+
+def test_a_failed_fetch_is_logged_with_the_origin_and_the_retry_time(
+    caplog: pytest.LogCaptureFixture,
+) -> None:
+    verifier = _verifier(directory_transport({}))  # every directory is 404
+    document = w.signed_commit(w.buyer_key())
+    with caplog.at_level(logging.INFO, "iab_agentic_primitives.web_bot_auth"):
+        request = document
+        expect_refusal(lambda: verifier.verify(request), Refusal.DIRECTORY_STATUS)
+    (fetch,) = [r for r in caplog.records if r.levelno == logging.WARNING]
+    message = fetch.getMessage()
+    assert w.BUYER in message and str(at(60)) in message and "directory-status" in message
+    assert any("403 directory-status" in r.getMessage() for r in caplog.records)
diff --git a/tests/web_bot_auth/test_wba_message.py b/tests/web_bot_auth/test_wba_message.py
new file mode 100644
index 0000000..017dcd4
--- /dev/null
+++ b/tests/web_bot_auth/test_wba_message.py
@@ -0,0 +1,139 @@
+"""The message model as callers use it: header input, signing that leaves the caller's
+message alone, and the lossless conformance documents.
+
+This module type-checks under strict mypy in blocking mode.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import base64
+import json
+from collections.abc import Iterator
+
+import pytest
+
+from iab_agentic_primitives.web_bot_auth import (
+    HeaderLines,
+    HTTPRequest,
+    HTTPResponse,
+    RequestSigner,
+    ResponseSigner,
+)
+from iab_agentic_primitives.web_bot_auth.conformance import LibraryAdapter
+from iab_agentic_primitives.web_bot_auth.conformance.models import RequestDoc, dump, read
+from iab_agentic_primitives.web_bot_auth.conformance.signing import sign_directory
+
+from . import support as w
+
+# ── header input ──────────────────────────────────────────────────────────
+
+
+def test_a_message_takes_only_str_header_lines() -> None:
+    # Raw ASGI header bytes must be decoded by the caller, never signed as they are.
+    with pytest.raises(TypeError):
+        HTTPRequest("GET", w.COMMIT_URL, [(b"a", b"b")])  # type: ignore[list-item]
+    with pytest.raises(TypeError):
+        HTTPRequest("GET", w.COMMIT_URL, {"a": 1})  # type: ignore[arg-type]
+
+
+def _lines() -> Iterator[tuple[str, str]]:
+    yield ("Content-Type", "application/json")
+    yield ("X-Trace", "t-1")
+
+
+def test_a_generator_of_headers_signs_the_same_as_a_list() -> None:
+    signer = RequestSigner.of(w.buyer_key(), w.BUYER)
+    nonce = "A" * 86
+    from_list = HTTPRequest("POST", w.COMMIT_URL, list(_lines()), w.COMMIT_BODY)
+    from_generator = HTTPRequest("POST", w.COMMIT_URL, HeaderLines(_lines()), w.COMMIT_BODY)
+    one = signer.sign(from_list, now=w.T0, nonce=nonce)
+    two = signer.sign(from_generator, now=w.T0, nonce=nonce)
+    assert one == two
+    assert one.headers.get_all("x-trace") == ("t-1",)
+    verifier = w.request_verifier()
+    assert asyncio.run(verifier.verify(two)).origin == w.BUYER_ORIGIN
+
+
+def test_a_response_to_a_request_with_generated_headers_binds() -> None:
+    request = w.signed_commit(w.buyer_key())
+    generated = HTTPRequest(
+        request.method, request.url, HeaderLines(iter(request.headers.items())), request.body
+    )
+    signer = ResponseSigner.of(w.seller_key(), w.SELLER)
+    one = signer.sign(HTTPResponse(200, w.JSON, w.COMMIT_RESULT_BODY, request), now=w.T0)
+    two = signer.sign(HTTPResponse(200, w.JSON, w.COMMIT_RESULT_BODY, generated), now=w.T0)
+    assert one.headers == two.headers
+    verified = asyncio.run(w.response_verifier().verify(two))
+    assert verified.bound
+
+
+def test_signing_returns_a_new_message_and_keeps_the_callers() -> None:
+    request = HTTPRequest("POST", w.COMMIT_URL, w.JSON, w.COMMIT_BODY)
+    signed = RequestSigner.of(w.buyer_key(), w.BUYER).sign(request, now=w.T0)
+    assert request.headers == HeaderLines(w.JSON)
+    assert signed.headers.items()[:1] == request.headers.items()
+    assert [n for n, _ in signed.headers.items()[1:]] == [
+        "Content-Digest",
+        "Signature-Agent",
+        "Signature-Input",
+        "Signature",
+    ]
+
+
+# ── the conformance documents ─────────────────────────────────────────────
+
+_BINARY = b"\xff\xfe\x00binary"
+_REPEATED = [["Content-Type", "application/octet-stream"], ["X-Trace", "a"], ["X-Trace", "b"]]
+
+
+def _op(op: str, **fields: object) -> str:
+    return json.dumps({"op": op, **fields})
+
+
+def test_a_binary_body_and_repeated_lines_round_trip_through_the_adapter() -> None:
+    adapter = LibraryAdapter()
+    request = {
+        "method": "POST",
+        "url": w.COMMIT_URL,
+        "headers": _REPEATED,
+        "body": {"base64": base64.b64encode(_BINARY).decode()},
+    }
+    jwk = w.buyer_key().private_jwk()
+    key = {name: jwk[name] for name in ("kty", "crv", "x", "d")}
+    signed = json.loads(
+        adapter.serve(_op("sign_request", key=key, origin=w.BUYER, request=request, now=w.T0))
+    )
+    assert signed["headers"][:3] == _REPEATED and signed["body"] == request["body"]
+    directory = sign_directory([w.buyer_key()], w.BUYER, w.T0)
+    verify = _op(
+        "verify_request",
+        request=signed,
+        authority="seller.example.com",
+        directories={w.BUYER: dump(directory)},
+        now=w.T0,
+    )
+    assert json.loads(adapter.serve(verify)) == {
+        "ok": True,
+        "identity": w.BUYER,
+        "keyid": w.buyer_key().thumbprint,
+        "body_covered": True,
+    }
+
+
+def test_a_document_is_frozen_hashable_and_lossless() -> None:
+    signed = RequestSigner.of(w.buyer_key(), w.BUYER).sign(
+        HTTPRequest("POST", w.COMMIT_URL, [(name, value) for name, value in _REPEATED], _BINARY),
+        now=w.T0,
+    )
+    document = RequestDoc.of(signed)
+    assert read(RequestDoc, json.dumps(dump(document))) == document
+    assert document.message() == signed
+    assert hash(document) == hash(RequestDoc.of(signed))
+    with pytest.raises(TypeError):
+        document.headers["X-Trace"] = "c"  # type: ignore[index]
+
+
+def test_a_document_stores_a_utf_8_body_as_text() -> None:
+    document = dump(RequestDoc.of(w.signed_commit(w.buyer_key())))
+    assert isinstance(document, dict) and document["body"] == w.COMMIT_BODY.decode()
diff --git a/tests/web_bot_auth/test_wba_request_verifier.py b/tests/web_bot_auth/test_wba_request_verifier.py
new file mode 100644
index 0000000..dfc834e
--- /dev/null
+++ b/tests/web_bot_auth/test_wba_request_verifier.py
@@ -0,0 +1,858 @@
+"""RequestSigner and RequestVerifier: every profile rule and every refusal."""
+
+from __future__ import annotations
+
+import base64
+import threading
+from collections.abc import Callable
+from dataclasses import replace
+from typing import Literal, TypedDict, Unpack
+
+import http_sf
+import pytest
+
+from iab_agentic_primitives.web_bot_auth import (
+    CONFORMANCE_KEYS,
+    DIRECTORY_PATH,
+    Ed25519Key,
+    HeaderLines,
+    HTTPRequest,
+    KeyPolicy,
+    MemoryNonceStore,
+    NonceStoreUnavailable,
+    Origin,
+    Refusal,
+    RequestSigner,
+    RequestVerifier,
+    ResponseSigner,
+    Seconds,
+    ServerIdentity,
+    SigningError,
+    StaticKeyResolver,
+    UnixSeconds,
+    WebBotAuthError,
+    accept_signature,
+)
+from iab_agentic_primitives.web_bot_auth.conformance import scenarios_document, vectors
+from iab_agentic_primitives.web_bot_auth.conformance.models import NonceSpec, SignatureParameters
+from iab_agentic_primitives.web_bot_auth.conformance.signing import (
+    MessageDeparture,
+    sign_request_scenario,
+)
+from iab_agentic_primitives.web_bot_auth.rules import CONTENT_DIGEST, signature_agent_component
+from iab_agentic_primitives.web_bot_auth.sync import SyncRequestVerifier, SyncRuntime
+
+from . import support as w
+from .support import (
+    BUYER,
+    BUYER_ORIGIN,
+    COMMIT_BODY,
+    COMMIT_URL,
+    JSON,
+    OTHER,
+    SELLER_IDENTITY,
+    T0,
+    at,
+    b64url,
+    b64url_bytes,
+    craft,
+    expect_refusal,
+    verify,
+)
+from .support import digest as content_digest
+
+KEYS_PATH = DIRECTORY_PATH
+
+# Nonces the profile refuses: 64 bytes is the only length, in base64url or padded base64.
+BAD_NONCES = [
+    "short",
+    "not base64!",
+    b64url(bytes(32)),
+    b64url(bytes(65)),
+    base64.urlsafe_b64encode(b"\xfb" * 64).decode(),  # padded, with base64url's - and _
+    base64.urlsafe_b64encode(bytes(range(64)) + b"\xfb").decode()[:-4],  # 66 bytes, cut
+]
+
+# ── signing ───────────────────────────────────────────────────────────────
+
+
+def test_signer_adds_the_four_headers_and_covers_the_profile_components(
+    buyer_key: Ed25519Key,
+) -> None:
+    added = w.request_added(
+        RequestSigner.of(buyer_key, BUYER), "POST", COMMIT_URL, JSON, COMMIT_BODY, now=T0
+    )
+    assert list(added) == ["Content-Digest", "Signature-Agent", "Signature-Input", "Signature"]
+    assert added["Signature-Agent"] == f'sig1="{BUYER}{KEYS_PATH}"'
+    params = added["Signature-Input"]
+    # The committed vector is the oracle: the generator signed it at the same components.
+    golden = w.POSITIVE_001.headers["Signature-Input"]
+    assert params.startswith(golden.split(";created")[0] + ";")
+    for part in (
+        f"created={T0}",
+        f"expires={at(300)}",
+        f'keyid="{buyer_key.thumbprint}"',
+        'alg="ed25519"',
+        'tag="web-bot-auth"',
+        "nonce=",
+    ):
+        assert part in params
+
+
+def test_signer_without_a_body_adds_no_digest(buyer_key: Ed25519Key) -> None:
+    added = w.request_added(
+        RequestSigner.of(buyer_key, BUYER), "GET", f"{w.SELLER}/proposals", now=T0
+    )
+    assert "Content-Digest" not in added
+    for component in w.BODY_COMPONENTS:
+        assert str(component) not in added["Signature-Input"]
+
+
+def test_signer_is_deterministic_for_a_fixed_nonce(buyer_key: Ed25519Key) -> None:
+    signer = RequestSigner.of(buyer_key, BUYER)
+    nonce = "A" * 86
+    one = w.request_added(signer, "POST", COMMIT_URL, JSON, COMMIT_BODY, now=T0, nonce=nonce)
+    two = w.request_added(signer, "POST", COMMIT_URL, JSON, COMMIT_BODY, now=T0, nonce=nonce)
+    assert one == two
+
+
+def test_signer_reuses_a_matching_digest_and_refuses_a_wrong_one(buyer_key: Ed25519Key) -> None:
+    signer = RequestSigner.of(buyer_key, BUYER)
+    digest = content_digest(COMMIT_BODY)
+    added = w.request_added(
+        signer, "POST", COMMIT_URL, {**JSON, "Content-Digest": digest}, COMMIT_BODY, now=T0
+    )
+    assert "Content-Digest" not in added
+    with pytest.raises(ValueError, match="Content-Digest"):
+        w.request_added(
+            signer,
+            "POST",
+            COMMIT_URL,
+            {**JSON, "Content-Digest": content_digest(b"x")},
+            COMMIT_BODY,
+        )
+
+
+@pytest.mark.parametrize("existing", ["Signature", "Signature-Input", "Signature-Agent"])
+def test_signer_signs_once_per_message(buyer_key: Ed25519Key, existing: str) -> None:
+    with pytest.raises(ValueError, match="once per message"):
+        w.request_added(
+            RequestSigner.of(buyer_key, BUYER),
+            "POST",
+            COMMIT_URL,
+            {**JSON, existing: "x"},
+            COMMIT_BODY,
+        )
+
+
+def test_signer_needs_content_type_with_a_body(buyer_key: Ed25519Key) -> None:
+    with pytest.raises(ValueError, match="Content-Type"):
+        w.request_added(RequestSigner.of(buyer_key, BUYER), "POST", COMMIT_URL, {}, COMMIT_BODY)
+
+
+@pytest.mark.parametrize("nonce", BAD_NONCES)
+def test_signer_refuses_a_nonce_the_profile_does_not_allow(
+    buyer_key: Ed25519Key, nonce: str
+) -> None:
+    with pytest.raises(SigningError, match="nonce"):
+        w.request_added(RequestSigner.of(buyer_key, BUYER), "GET", COMMIT_URL, nonce=nonce)
+
+
+def test_each_signing_draws_a_fresh_64_byte_nonce(
+    verifier: RequestVerifier, buyer_key: Ed25519Key
+) -> None:
+    one, two = (verify(verifier, w.signed_commit(buyer_key)) for _ in range(2))
+    assert one.nonce != two.nonce
+    assert "=" not in one.nonce and len(b64url_bytes(one.nonce)) == 64
+
+
+# ── verification: the happy path ──────────────────────────────────────────
+
+
+def test_signed_commit_verifies(verifier: RequestVerifier, buyer_key: Ed25519Key) -> None:
+    result = verify(verifier, w.signed_commit(buyer_key))
+    assert result.origin == BUYER_ORIGIN
+    assert result.keyid == buyer_key.thumbprint
+    assert result.label == "sig1"
+    assert (result.created, result.expires) == (T0, at(300))
+    assert result.body_covered is True
+    assert signature_agent_component("sig1") in result.components
+    assert CONTENT_DIGEST in result.components
+
+
+def test_signed_get_verifies_without_body_coverage(
+    verifier: RequestVerifier, buyer_key: Ed25519Key
+) -> None:
+    url = f"{w.SELLER}/proposals/prop_7?view=a%7Eb&x=1"
+    added = w.request_added(RequestSigner.of(buyer_key, BUYER), "GET", url, now=T0)
+    result = verify(verifier, HTTPRequest("GET", url, added))
+    assert result.body_covered is False
+
+
+def test_verify_sync(verifier: RequestVerifier, buyer_key: Ed25519Key) -> None:
+    r = w.signed_commit(buyer_key)
+    with SyncRuntime() as runtime:
+        assert SyncRequestVerifier(verifier, runtime=runtime).verify(r).origin == BUYER_ORIGIN
+
+
+def test_header_names_are_case_insensitive_and_lines_combine(
+    verifier: RequestVerifier, buyer_key: Ed25519Key
+) -> None:
+    r = w.signed_commit(buyer_key)
+    lines = [(k.lower(), v) for k, v in r.headers]
+    assert verify(verifier, replace(r, headers=HeaderLines(lines))).origin == BUYER_ORIGIN
+
+
+@pytest.mark.parametrize("label", ["wba", "a1"])
+def test_any_label(verifier: RequestVerifier, buyer_key: Ed25519Key, label: str) -> None:
+    assert verify(verifier, craft(buyer_key, label=label)).label == label
+
+
+def test_components_in_another_order(verifier: RequestVerifier, buyer_key: Ed25519Key) -> None:
+    components = list(reversed(w.post_components()))
+    assert verify(verifier, craft(buyer_key, components=components)).origin == BUYER_ORIGIN
+
+
+@pytest.mark.parametrize("encoding", ["base64url", "base64"])
+def test_both_nonce_encodings(
+    verifier: RequestVerifier, buyer_key: Ed25519Key, encoding: Literal["base64url", "base64"]
+) -> None:
+    nonce = SignatureParameters(nonce=NonceSpec(bytes=64, encoding=encoding))
+    assert verify(verifier, craft(buyer_key, params=nonce)).origin == BUYER_ORIGIN
+
+
+@pytest.mark.parametrize("value", [f"{BUYER}{KEYS_PATH}", BUYER])
+def test_key_url_and_bare_origin_forms_name_the_same_identity(
+    verifier: RequestVerifier, buyer_key: Ed25519Key, value: str
+) -> None:
+    result = verify(verifier, craft(buyer_key, agent=f'sig1="{value}"'))
+    assert (result.origin, result.origin.host) == (BUYER_ORIGIN, "buyer.example.com")
+
+
+def test_a_second_signature_with_another_tag_is_not_read(
+    verifier: RequestVerifier, buyer_key: Ed25519Key, other_key: Ed25519Key
+) -> None:
+    scenarios = scenarios_document()
+    s = next(s for s in scenarios.request_scenarios if s.id == "R20")
+    keys: dict[str, Ed25519Key] = {buyer_key.thumbprint: buyer_key, other_key.thumbprint: other_key}
+    request = sign_request_scenario(scenarios, s, keys, T0)
+    assert w.run(verifier.verify(request)).origin == BUYER_ORIGIN
+
+
+# ── the window and the clock skew ─────────────────────────────────────────
+
+
+@pytest.mark.parametrize(
+    ("created", "expires", "refusal"),
+    [
+        (60, 300, None),
+        (61, 300, Refusal.CREATED_IN_FUTURE),
+        (-360, -60, None),
+        (-361, -61, Refusal.EXPIRED),
+        (-5, 295, None),
+        (0, 301, Refusal.LIFETIME),
+        (10, 5, Refusal.WINDOW),
+    ],
+)
+def test_window(
+    verifier: RequestVerifier,
+    buyer_key: Ed25519Key,
+    created: int,
+    expires: int,
+    refusal: Refusal | None,
+) -> None:
+    request = craft(buyer_key, params=SignatureParameters(created=created, expires=expires))
+    if refusal is None:
+        assert verify(verifier, request).origin == BUYER_ORIGIN
+    else:
+        expect_refusal(lambda: w.verify(verifier, request), refusal)
+
+
+def test_created_is_required(verifier: RequestVerifier, buyer_key: Ed25519Key) -> None:
+    request = w.signed_commit(buyer_key)
+    signature_input = request.headers["Signature-Input"].replace(f";created={T0}", "")
+    request = w.edited(request, headers={"Signature-Input": signature_input})
+    expect_refusal(lambda: w.verify(verifier, request), Refusal.WINDOW)
+
+
+def test_expires_is_required(verifier: RequestVerifier, buyer_key: Ed25519Key) -> None:
+    expect_refusal(
+        lambda: w.verify(verifier, craft(buyer_key, params=SignatureParameters(expires=None))),
+        Refusal.WINDOW,
+    )
+
+
+# ── refusals: 400 ─────────────────────────────────────────────────────────
+
+
+@pytest.mark.parametrize(
+    ("field", "value"),
+    [
+        ("Signature-Agent", f'sig1="{BUYER}'),
+        ("Signature-Agent", f'"{BUYER}"'),
+        ("Signature-Input", "sig1=("),
+        ("Signature", "sig1=:not base64:"),
+        ("Signature", "sig1=token"),
+        ("Signature-Input", 'sig1="string"'),
+        ("Signature-Agent", 'sig1="hé"'),
+    ],
+)
+def test_unparseable_fields_get_400(
+    verifier: RequestVerifier, buyer_key: Ed25519Key, field: str, value: str
+) -> None:
+    request = w.edited(w.signed_commit(buyer_key), headers={field: value})
+    expect_refusal(lambda: w.verify(verifier, request), Refusal.PARSE)
+
+
+def test_a_malformed_member_of_any_tag_is_a_400(
+    verifier: RequestVerifier, buyer_key: Ed25519Key
+) -> None:
+    """RFC 9421 sections 4.1 and 4.2 make every member's shape normative, whatever its tag.
+
+    Members with other tags aren't read, but a Signature member that isn't a
+    Byte Sequence makes the field malformed, so the request gets 400.
+    """
+    request = w.signed_commit(buyer_key)
+    cdn = f', cdn={w.inner_list([])};tag="cdn-edge"'
+    request = w.edited(
+        request,
+        headers={
+            "Signature-Input": request.headers["Signature-Input"] + cdn,
+            "Signature": request.headers["Signature"] + ", cdn=edge-token",
+        },
+    )
+    expect_refusal(lambda: w.verify(verifier, request), Refusal.PARSE)
+
+
+# ── refusals: 403 ─────────────────────────────────────────────────────────
+
+
+def test_unsigned_request(verifier: RequestVerifier) -> None:
+    expect_refusal(
+        lambda: w.verify(verifier, HTTPRequest("GET", COMMIT_URL)),
+        Refusal.SIGNATURE_MISSING,
+    )
+
+
+def test_no_web_bot_auth_tag(verifier: RequestVerifier, buyer_key: Ed25519Key) -> None:
+    expect_refusal(
+        lambda: w.verify(
+            verifier, craft(buyer_key, params=SignatureParameters(tag="other-profile/v1"))
+        ),
+        Refusal.SIGNATURE_MISSING,
+    )
+
+
+def test_two_web_bot_auth_signatures(verifier: RequestVerifier) -> None:
+    request = w.vector_request(dict(vectors())["negative/006-two-signatures"]).message()
+    expect_refusal(lambda: w.verify(verifier, request), Refusal.MULTIPLE_SIGNATURES)
+
+
+def test_signature_member_missing_for_the_label(
+    verifier: RequestVerifier, buyer_key: Ed25519Key
+) -> None:
+    request = w.signed_commit(buyer_key)
+    signature = request.headers["Signature"].replace("sig1=", "other=")
+    request = w.edited(request, headers={"Signature": signature})
+    expect_refusal(lambda: w.verify(verifier, request), Refusal.SIGNATURE_MISSING)
+
+
+def test_no_signature_agent(verifier: RequestVerifier, buyer_key: Ed25519Key) -> None:
+    request = w.edited(w.signed_commit(buyer_key), headers={"Signature-Agent": None})
+    expect_refusal(lambda: w.verify(verifier, request), Refusal.SIGNATURE_AGENT_MISSING)
+
+
+def test_two_signature_agent_members(verifier: RequestVerifier, buyer_key: Ed25519Key) -> None:
+    request = craft(buyer_key, agent=f'sig1="{BUYER}", sig2="{OTHER}"')
+    expect_refusal(lambda: w.verify(verifier, request), Refusal.MULTIPLE_SIGNATURE_AGENTS)
+
+
+def test_member_keyed_differently_from_the_label(
+    verifier: RequestVerifier, buyer_key: Ed25519Key
+) -> None:
+    components = w.post_components("agent1")
+    request = craft(buyer_key, agent=f'agent1="{BUYER}"', components=components)
+    expect_refusal(lambda: w.verify(verifier, request), Refusal.SIGNATURE_AGENT_MISSING)
+
+
+def test_member_not_covered(verifier: RequestVerifier, buyer_key: Ed25519Key) -> None:
+    components = w.post_components()[:-1]
+    expect_refusal(
+        lambda: w.verify(verifier, craft(buyer_key, components=components)),
+        Refusal.SIGNATURE_AGENT_NOT_COVERED,
+    )
+
+
+def test_whole_field_covered_instead_of_the_member(
+    verifier: RequestVerifier, buyer_key: Ed25519Key
+) -> None:
+    agent = signature_agent_component("sig1")
+    components = [*w.post_components()[:-1], agent.name]
+    expect_refusal(
+        lambda: w.verify(verifier, craft(buyer_key, components=components)),
+        Refusal.SIGNATURE_AGENT_NOT_COVERED,
+    )
+
+
+@pytest.mark.parametrize(
+    "member",
+    [
+        f'sig1="{BUYER}/jwks.json";type=jwks_uri',
+        f'sig1="{BUYER}";type=directory',
+        f'sig1="{BUYER}{KEYS_PATH}";type="directory"',
+        f'sig1="{BUYER}";type=cimd',
+        f'sig1="{BUYER}";x',
+    ],
+)
+def test_a_member_with_parameters_is_ignored(
+    verifier: RequestVerifier, buyer_key: Ed25519Key, member: str
+) -> None:
+    expect_refusal(
+        lambda: w.verify(verifier, craft(buyer_key, agent=member)),
+        Refusal.SIGNATURE_AGENT_PARAMETERS,
+    )
+
+
+def test_an_ignored_member_does_not_count(verifier: RequestVerifier, buyer_key: Ed25519Key) -> None:
+    agent = f'sig1="{BUYER}", other="{OTHER}";type=directory'
+    assert verify(verifier, craft(buyer_key, agent=agent)).origin == BUYER_ORIGIN
+
+
+@pytest.mark.parametrize(
+    "value",
+    [
+        f"http://buyer.example.com{KEYS_PATH}",
+        "http://buyer.example.com",
+        f"{BUYER}/",
+        f"{BUYER}/jwks.json",
+        f"{BUYER}{KEYS_PATH}/",
+        f"{BUYER}{KEYS_PATH}?v=1",
+        f"{BUYER}{KEYS_PATH}#k",
+        f"{BUYER}{KEYS_PATH.upper()}",
+        f"https://BUYER.example.com{KEYS_PATH}",
+        f"{BUYER}:443{KEYS_PATH}",
+        f"{BUYER}:8443",
+        f"https://agent@buyer.example.com{KEYS_PATH}",
+        "https://agent@buyer.example.com",
+        "HTTPS://buyer.example.com",
+        f"HTTPS://buyer.example.com{KEYS_PATH}",
+        "https://",
+        "buyer.example.com",
+        f"{BUYER}?v=1",
+        f"{BUYER}//.well-known/http-message-signatures-directory",
+        f"{BUYER}{KEYS_PATH}.json",
+    ],
+)
+def test_signature_agent_value_rule(
+    verifier: RequestVerifier, buyer_key: Ed25519Key, value: str
+) -> None:
+    expect_refusal(
+        lambda: w.verify(verifier, craft(buyer_key, agent=f'sig1="{value}"')),
+        Refusal.SIGNATURE_AGENT_VALUE,
+    )
+
+
+def test_member_value_that_is_not_a_string(
+    verifier: RequestVerifier, buyer_key: Ed25519Key
+) -> None:
+    expect_refusal(
+        lambda: w.verify(verifier, craft(buyer_key, agent="sig1=buyer")),
+        Refusal.SIGNATURE_AGENT_VALUE,
+    )
+
+
+@pytest.mark.parametrize("alg", [None, "ecdsa-p256-sha256", "rsa-pss-sha512"])
+def test_alg(verifier: RequestVerifier, buyer_key: Ed25519Key, alg: str | None) -> None:
+    expect_refusal(
+        lambda: w.verify(verifier, craft(buyer_key, params=SignatureParameters(alg=alg))),
+        Refusal.ALG,
+    )
+
+
+def test_keyid_missing(verifier: RequestVerifier, buyer_key: Ed25519Key) -> None:
+    expect_refusal(
+        lambda: w.verify(verifier, craft(buyer_key, params=SignatureParameters(keyid=""))),
+        Refusal.KEYID,
+    )
+
+
+def test_a_request_without_a_nonce_is_refused(
+    verifier: RequestVerifier, buyer_key: Ed25519Key
+) -> None:
+    signed = craft(buyer_key, params=SignatureParameters(nonce=None))
+    expect_refusal(lambda: w.verify(verifier, signed), Refusal.NONCE_MISSING)
+
+
+@pytest.mark.parametrize(
+    "nonce",
+    [
+        NonceSpec(bytes=32, encoding="base64url"),
+        NonceSpec(bytes=64, encoding="base64url-padded"),
+        *BAD_NONCES,
+    ],
+)
+def test_a_nonce_the_profile_does_not_allow_is_refused(
+    verifier: RequestVerifier, buyer_key: Ed25519Key, nonce: NonceSpec | str
+) -> None:
+    signed = craft(buyer_key, params=SignatureParameters(nonce=nonce))
+    expect_refusal(lambda: w.verify(verifier, signed), Refusal.NONCE_INVALID)
+
+
+@pytest.mark.parametrize("dropped", w.post_components()[:-1])
+def test_each_required_component(
+    verifier: RequestVerifier, buyer_key: Ed25519Key, dropped: str
+) -> None:
+    components = [c for c in w.POST_COMPONENTS if c != dropped]
+    expect_refusal(
+        lambda: w.verify(verifier, craft(buyer_key, components=components)), Refusal.COMPONENTS
+    )
+
+
+def test_get_needs_method_and_target_uri(verifier: RequestVerifier, buyer_key: Ed25519Key) -> None:
+    request = craft(buyer_key, method="GET", body=b"", components=w.get_components()[2:])
+    expect_refusal(lambda: w.verify(verifier, request), Refusal.COMPONENTS)
+
+
+def test_authority_with_parameters_does_not_count(
+    verifier: RequestVerifier, buyer_key: Ed25519Key
+) -> None:
+    authority = w.get_components()[2]
+    components = ["@query-param;name=x" if c == authority else c for c in w.get_components()]
+    url = f"{COMMIT_URL}?x=1"
+    request = craft(buyer_key, method="GET", url=url, body=b"", components=components)
+    expect_refusal(lambda: w.verify(verifier, request), Refusal.COMPONENTS)
+
+
+def test_body_changed_after_signing(verifier: RequestVerifier, buyer_key: Ed25519Key) -> None:
+    request = w.signed_commit(buyer_key)
+    request = w.edited(request, body=request.body + b"\n")
+    expect_refusal(lambda: w.verify(verifier, request), Refusal.CONTENT_DIGEST)
+
+
+def test_body_added_to_a_signed_get(verifier: RequestVerifier, buyer_key: Ed25519Key) -> None:
+    url = f"{w.SELLER}/proposals"
+    added = w.request_added(RequestSigner.of(buyer_key, BUYER), "GET", url, now=T0)
+    expect_refusal(
+        lambda: w.verify(verifier, HTTPRequest("GET", url, added, b"{}")),
+        Refusal.COMPONENTS,
+    )
+
+
+@pytest.mark.parametrize(
+    "change",
+    [
+        lambda r: w.edited(r, headers={"Content-Type": "text/plain"}),
+        lambda r: w.edited(r, url=COMMIT_URL + "?x=1"),
+        lambda r: w.edited(r, url=COMMIT_URL.replace("seller", "other")),
+        lambda r: replace(r, method="PUT"),
+    ],
+    ids=["content-type", "target-uri", "authority", "method"],
+)
+def test_covered_value_changed_after_signing(
+    buyer_key: Ed25519Key, change: Callable[[HTTPRequest], HTTPRequest]
+) -> None:
+    # The verifier is the server the changed request names, so a changed @authority
+    # passes the authority check and reaches the signature check.
+    request = change(w.signed_commit(buyer_key))
+    verifier = RequestVerifier(
+        StaticKeyResolver({BUYER: [buyer_key]}),
+        identity=ServerIdentity.from_config(str(Origin.of_url(request.url))),
+        nonces=MemoryNonceStore(clock=lambda: T0),
+        clock=lambda: T0,
+        keys=CONFORMANCE_KEYS,
+    )
+    expect_refusal(lambda: w.verify(verifier, request), Refusal.SIGNATURE_INVALID)
+
+
+def test_a_parameter_appended_after_signing_is_tampering(
+    verifier: RequestVerifier, buyer_key: Ed25519Key
+) -> None:
+    request = w.signed_commit(buyer_key)
+    extra = request.headers["Signature-Input"] + ";extra=1"
+    request = w.edited(request, headers={"Signature-Input": extra})
+    expect_refusal(lambda: w.verify(verifier, request), Refusal.SIGNATURE_INVALID)
+
+
+def test_key_not_in_the_named_directory(verifier: RequestVerifier, buyer_key: Ed25519Key) -> None:
+    request = w.signed_commit(buyer_key, origin=OTHER)
+    expect_refusal(lambda: w.verify(verifier, request), Refusal.KEY_NOT_FOUND)
+
+
+def test_key_lookup_is_by_origin_and_keyid(buyer_key: Ed25519Key) -> None:
+    # The key is known, but only under another origin: a lookup by keyid alone would accept.
+    resolver = StaticKeyResolver({OTHER: [buyer_key], BUYER: []})
+    verifier = RequestVerifier(
+        resolver,
+        identity=SELLER_IDENTITY,
+        nonces=MemoryNonceStore(clock=lambda: T0),
+        clock=lambda: T0,
+        keys=CONFORMANCE_KEYS,
+    )
+    expect_refusal(lambda: w.verify(verifier, w.signed_commit(buyer_key)), Refusal.KEY_NOT_FOUND)
+
+
+def test_rejected_keyids(buyer_key: Ed25519Key) -> None:
+    resolver = StaticKeyResolver({BUYER: [buyer_key]})
+    verifier = RequestVerifier(
+        resolver,
+        identity=SELLER_IDENTITY,
+        nonces=MemoryNonceStore(clock=lambda: T0),
+        clock=lambda: T0,
+        keys=KeyPolicy(reject_keyids={buyer_key.thumbprint}),
+    )
+    expect_refusal(lambda: w.verify(verifier, w.signed_commit(buyer_key)), Refusal.REJECTED_KEY)
+
+
+# ── refusals: 429 ─────────────────────────────────────────────────────────
+
+
+def test_replayed_nonce_gets_429(verifier: RequestVerifier, buyer_key: Ed25519Key) -> None:
+    request = w.signed_commit(buyer_key)
+    verify(verifier, request)
+    expect_refusal(lambda: w.verify(verifier, request), Refusal.NONCE_REPLAYED)
+
+
+def test_replay_is_per_origin_and_the_ttl_covers_the_window(buyer_key: Ed25519Key) -> None:
+    stored: dict[tuple[Origin, str], Seconds] = {}
+
+    class Recording(MemoryNonceStore):
+        async def check_and_record(self, origin: Origin, nonce: str, ttl: Seconds) -> bool:
+            stored[(origin, nonce)] = ttl
+            return await super().check_and_record(origin, nonce, ttl)
+
+    verifier = RequestVerifier(
+        StaticKeyResolver({BUYER: [buyer_key]}),
+        identity=SELLER_IDENTITY,
+        nonces=Recording(clock=lambda: at(10)),
+        keys=CONFORMANCE_KEYS,
+    )
+    verify(verifier, w.signed_commit(buyer_key), now=at(10))
+    (ttl,) = stored.values()
+    assert ttl == 300 - 10 + 60
+
+
+def test_a_failed_verification_records_no_nonce(buyer_key: Ed25519Key) -> None:
+    store = MemoryNonceStore(clock=lambda: T0)
+    verifier = RequestVerifier(
+        StaticKeyResolver({BUYER: [buyer_key]}),
+        identity=SELLER_IDENTITY,
+        nonces=store,
+        clock=lambda: T0,
+        keys=CONFORMANCE_KEYS,
+    )
+    request = w.signed_commit(buyer_key)
+    tampered = w.edited(request, body=request.body + b" ")
+    expect_refusal(lambda: w.verify(verifier, tampered), Refusal.CONTENT_DIGEST)
+    assert len(store) == 0
+    assert verify(verifier, request).origin == BUYER_ORIGIN
+
+
+@pytest.mark.parametrize("has_body", [True, False], ids=["post", "get"])
+def test_a_request_signed_as_accept_signature_asks_verifies(
+    verifier: RequestVerifier, buyer_key: Ed25519Key, has_body: bool
+) -> None:
+    parsed = http_sf.parse(accept_signature(has_body=has_body).encode(), tltype="dictionary")
+    assert isinstance(parsed, dict)
+    ((label, member),) = parsed.items()
+    assert isinstance(member, tuple)
+    inner, parameters = member
+    assert isinstance(inner, list)
+    assert parameters == {
+        "created": True,
+        "expires": True,
+        "nonce": True,
+        "keyid": True,
+        "alg": "ed25519",
+        "tag": "web-bot-auth",
+    }
+    components = []
+    for item in inner:
+        assert isinstance(item, tuple)
+        name, ps = item
+        assert isinstance(name, str)
+        components.append(name + "".join(f";{k}={v!s}" for k, v in ps.items()))
+    body = COMMIT_BODY if has_body else b""
+    method = "POST" if has_body else "GET"
+    request = craft(buyer_key, method=method, body=body, label=label, components=components)
+    assert verify(verifier, request).body_covered is has_body
+
+
+# ── review regressions ────────────────────────────────────────────────────
+
+
+@pytest.mark.parametrize(
+    ("field", "refusal"),
+    [
+        ("Signature-Agent", Refusal.MULTIPLE_SIGNATURE_AGENTS),
+        ("Signature-Input", Refusal.MULTIPLE_SIGNATURES),
+        ("Signature", Refusal.MULTIPLE_SIGNATURES),
+    ],
+)
+def test_a_repeated_member_gets_403_not_400(
+    verifier: RequestVerifier, buyer_key: Ed25519Key, field: str, refusal: Refusal
+) -> None:
+    request = w.signed_commit(buyer_key)
+    value = request.headers[field]
+    request = w.edited(request, headers={field: f"{value}, {value}"})
+    expect_refusal(lambda: w.verify(verifier, request), refusal)
+
+
+def test_a_duplicate_parameter_is_still_a_parse_failure(
+    verifier: RequestVerifier, buyer_key: Ed25519Key
+) -> None:
+    request = w.signed_commit(buyer_key)
+    tagged = request.headers["Signature-Input"] + ';tag="web-bot-auth"'
+    request = w.edited(request, headers={"Signature-Input": tagged})
+    expect_refusal(lambda: w.verify(verifier, request), Refusal.PARSE)
+
+
+def test_a_request_digest_without_sha_256_is_refused(
+    verifier: RequestVerifier, buyer_key: Ed25519Key
+) -> None:
+    unchecked = MessageDeparture(
+        content_digest=w.digest_without_sha256(COMMIT_BODY), signature_agent=f'sig1="{BUYER}"'
+    )
+    signed = w.sign_request(
+        HTTPRequest("POST", COMMIT_URL, JSON, COMMIT_BODY), now=T0, departure=unchecked
+    )
+    expect_refusal(lambda: w.verify(verifier, signed), Refusal.CONTENT_DIGEST)
+
+
+def test_signers_refuse_a_supplied_digest_without_sha_256(
+    buyer_key: Ed25519Key, seller_key: Ed25519Key
+) -> None:
+    headers = {**JSON, "Content-Digest": w.digest_without_sha256(COMMIT_BODY)}
+    with pytest.raises(ValueError, match="sha-256"):
+        w.request_added(
+            RequestSigner.of(buyer_key, BUYER), "POST", COMMIT_URL, headers, COMMIT_BODY, now=T0
+        )
+    with pytest.raises(ValueError, match="sha-256"):
+        w.response_added(
+            ResponseSigner.of(seller_key, w.SELLER),
+            200,
+            headers,
+            COMMIT_BODY,
+            HTTPRequest("GET", COMMIT_URL, {}),
+            now=T0,
+        )
+    both = {
+        **JSON,
+        "Content-Digest": f"{w.digest_without_sha256(COMMIT_BODY)}, {content_digest(COMMIT_BODY)}",
+    }
+    assert "Content-Digest" not in w.request_added(
+        RequestSigner.of(buyer_key, BUYER), "POST", COMMIT_URL, both, COMMIT_BODY
+    )
+
+
+class StoreOptions(TypedDict, total=False):
+    """The :class:`MemoryNonceStore` options a test sets."""
+
+    max_entries: int
+
+
+def _clocked_verifier(
+    buyer_key: Ed25519Key, now: list[UnixSeconds], **store: Unpack[StoreOptions]
+) -> RequestVerifier:
+    """A verifier whose clock and nonce store read ``now[0]``."""
+    return RequestVerifier(
+        StaticKeyResolver({BUYER: [buyer_key]}),
+        identity=SELLER_IDENTITY,
+        nonces=MemoryNonceStore(clock=lambda: now[0], **store),
+        clock=lambda: now[0],
+        keys=CONFORMANCE_KEYS,
+    )
+
+
+def test_a_full_nonce_store_answers_503_not_429_until_its_nonces_expire(
+    buyer_key: Ed25519Key,
+) -> None:
+    now = [T0]
+    verifier = _clocked_verifier(buyer_key, now, max_entries=1)
+    first = w.signed_commit(buyer_key)
+    verify(verifier, first)
+    again = w.signed_commit(buyer_key)
+    expect_refusal(lambda: w.verify(verifier, again), Refusal.NONCE_STORE_UNAVAILABLE)
+    expect_refusal(lambda: w.verify(verifier, first), Refusal.NONCE_REPLAYED)
+    # Once the first nonce's window and skew have passed, its space is free again.
+    now[0] = at(300 + 60 + 1)
+    assert verify(verifier, w.signed_commit(buyer_key, now=now[0])).origin == BUYER_ORIGIN
+
+
+def test_a_replay_in_the_last_second_the_window_allows_is_still_a_replay(
+    buyer_key: Ed25519Key,
+) -> None:
+    now = [T0]
+    verifier = _clocked_verifier(buyer_key, now)
+    request = w.signed_commit(buyer_key)
+    verify(verifier, request)
+    now[0] = at(300 + 60)  # expires, plus the skew: the last second the request is good
+    expect_refusal(lambda: w.verify(verifier, request), Refusal.NONCE_REPLAYED)
+    now[0] = UnixSeconds(now[0] + 1)
+    expect_refusal(lambda: w.verify(verifier, request), Refusal.EXPIRED)
+
+
+def test_concurrent_verifications_of_one_request_accept_it_once(buyer_key: Ed25519Key) -> None:
+    # Sixteen threads verify through one runtime, as threaded code shares a resolver.
+    verifier = _clocked_verifier(buyer_key, [T0])
+    request = w.signed_commit(buyer_key)
+    barrier = threading.Barrier(16)
+    outcomes: list[Origin | Refusal] = []
+    with SyncRuntime() as runtime:
+        sync = SyncRequestVerifier(verifier, runtime=runtime)
+
+        def attempt() -> None:
+            barrier.wait()
+            try:
+                outcomes.append(sync.verify(request).origin)
+            except WebBotAuthError as e:
+                outcomes.append(e.refusal)
+
+        threads = [threading.Thread(target=attempt) for _ in range(16)]
+        for t in threads:
+            t.start()
+        for t in threads:
+            t.join()
+    assert outcomes.count(BUYER_ORIGIN) == 1
+    assert outcomes.count(Refusal.NONCE_REPLAYED) == 15
+
+
+def test_a_failing_nonce_store_answers_503(buyer_key: Ed25519Key) -> None:
+    class Down:
+        async def check_and_record(self, origin: Origin, nonce: str, ttl: Seconds) -> bool:
+            raise NonceStoreUnavailable("redis is down")
+
+    verifier = RequestVerifier(
+        StaticKeyResolver({BUYER: [buyer_key]}),
+        identity=SELLER_IDENTITY,
+        nonces=Down(),
+        clock=lambda: T0,
+        keys=CONFORMANCE_KEYS,
+    )
+    request = w.signed_commit(buyer_key)
+    expect_refusal(lambda: w.verify(verifier, request), Refusal.NONCE_STORE_UNAVAILABLE)
+
+
+@pytest.mark.parametrize(
+    "host", ["2130706433", "127.1", "1.2.3.04", "0x7f.0.0.1", "a.0x10", "[fe80::1%25en0]"]
+)
+def test_number_shaped_hosts_are_not_identities(
+    verifier: RequestVerifier, buyer_key: Ed25519Key, host: str
+) -> None:
+    request = craft(buyer_key, agent=f'sig1="https://{host}{KEYS_PATH}"')
+    expect_refusal(lambda: w.verify(verifier, request), Refusal.SIGNATURE_AGENT_VALUE)
+
+
+def test_a_nonce_store_bug_propagates_instead_of_answering_503(buyer_key: Ed25519Key) -> None:
+    class Broken:
+        async def check_and_record(self, origin: Origin, nonce: str, ttl: Seconds) -> bool:
+            raise ConnectionError("not a NonceStoreUnavailable")
+
+    verifier = RequestVerifier(
+        StaticKeyResolver({BUYER: [buyer_key]}),
+        identity=SELLER_IDENTITY,
+        nonces=Broken(),
+        clock=lambda: T0,
+        keys=CONFORMANCE_KEYS,
+    )
+    with pytest.raises(ConnectionError):
+        verify(verifier, w.signed_commit(buyer_key))
diff --git a/tests/web_bot_auth/test_wba_resolver.py b/tests/web_bot_auth/test_wba_resolver.py
new file mode 100644
index 0000000..1807aef
--- /dev/null
+++ b/tests/web_bot_auth/test_wba_resolver.py
@@ -0,0 +1,1130 @@
+"""DirectoryResolver: fetch rules, the store's rules, one fetch per origin, and the fetcher."""
+
+from __future__ import annotations
+
+import asyncio
+import base64
+import json
+import subprocess
+import sys
+import time
+from collections.abc import AsyncIterator, Callable, Sequence
+from functools import partial
+from pathlib import Path
+from typing import TypedDict
+
+import httpx
+import pytest
+
+from iab_agentic_primitives.web_bot_auth import (
+    CONFORMANCE_KEYS,
+    DIRECTORY_PATH,
+    Answer,
+    CachePolicy,
+    Clock,
+    ConfigurationError,
+    DirectoryResolver,
+    DirectoryResponse,
+    DirectoryStore,
+    DirectoryStoreUnavailable,
+    Ed25519Key,
+    FetchLimits,
+    HeaderLines,
+    HTTPResponse,
+    KeyId,
+    MemoryDirectoryStore,
+    MemoryNonceStore,
+    Origin,
+    PublishPolicy,
+    Refusal,
+    RequestVerifier,
+    ResolvedKey,
+    StaticKeyResolver,
+    UnixSeconds,
+    WebBotAuthError,
+    publish_directory,
+    verify_directory,
+)
+from iab_agentic_primitives.web_bot_auth.fetcher import (
+    BlockedAddress,
+    HttpxDirectoryFetcher,
+    TLSConfig,
+)
+from iab_agentic_primitives.web_bot_auth.testing import (
+    check_directory_store,
+    check_nonce_store,
+    directory_transport,
+)
+
+from . import support as w
+from .support import BUYER, BUYER_ORIGIN, SELLER_IDENTITY, T0, Clocked, at, expect_refusal, run
+
+
+class Server:
+    """Serves the buyer's directory and counts fetches; tests swap what it serves."""
+
+    def __init__(
+        self,
+        keys: Sequence[Ed25519Key],
+        now: UnixSeconds = T0,
+        policy: PublishPolicy | None = None,
+    ) -> None:
+        self.fetches = 0
+        self.serve(keys, now, policy)
+
+    def serve(
+        self, keys: Sequence[Ed25519Key], now: UnixSeconds = T0, policy: PublishPolicy | None = None
+    ) -> None:
+        answer = publish_directory(BUYER_ORIGIN, keys, now=now, policy=policy or PublishPolicy())
+        self.status, self.headers, self.body = (
+            answer.status,
+            dict(answer.headers.items()),
+            answer.body,
+        )
+
+    def fail(self, status: int = 503) -> None:
+        self.status, self.headers, self.body = status, {}, b""
+
+    def transport(self) -> httpx.MockTransport:
+        def handler(request: httpx.Request) -> httpx.Response:
+            self.fetches += 1
+            assert str(request.url) == BUYER + DIRECTORY_PATH  # exactly the well-known URL
+            assert request.headers["accept-encoding"] == "identity"
+            return httpx.Response(
+                self.status, headers=self.headers, stream=httpx.ByteStream(self.body)
+            )
+
+        return httpx.MockTransport(handler)
+
+
+def over(
+    transport: httpx.AsyncBaseTransport,
+    *,
+    store: DirectoryStore | None = None,
+    limits: FetchLimits | None = None,
+    clock: Clock = lambda: T0,
+    cache: CachePolicy | None = None,
+) -> Clocked:
+    """A resolver over ``transport``, resolving at ``clock``'s time."""
+    resolver = DirectoryResolver(
+        HttpxDirectoryFetcher(transport=transport),
+        store,
+        limits=limits or FetchLimits(),
+        cache=cache or CachePolicy(),
+        clock=clock,
+    )
+    return Clocked(resolver, clock)
+
+
+def resolver(server: Server, now: list[UnixSeconds], **limits: int) -> Clocked:
+    return over(server.transport(), limits=FetchLimits(**limits), clock=lambda: now[0])
+
+
+def resolve(r: Clocked, kid: KeyId, origin: Origin = BUYER_ORIGIN) -> ResolvedKey:
+    return run(r.resolve(origin, kid))
+
+
+class Fetcher:
+    """A DirectoryFetcher that serves the buyer's directory, counts calls, and can raise."""
+
+    def __init__(
+        self,
+        keys: Sequence[Ed25519Key],
+        *,
+        error: BaseException | None = None,
+        delay: float = 0.0,
+    ) -> None:
+        self.calls = 0
+        self.status, self.headers, self.body = w.signed_directory(BUYER, keys)
+        self.error, self.delay = error, delay
+
+    async def fetch(
+        self, origin: Origin, *, limits: FetchLimits, now: UnixSeconds
+    ) -> DirectoryResponse:
+        self.calls += 1
+        await asyncio.sleep(self.delay)
+        if self.error is not None:
+            raise self.error
+        return DirectoryResponse(origin.directory_url, self.status, self.headers, self.body, now)
+
+
+# ── the store's rules ─────────────────────────────────────────────────────
+
+
+def test_a_fresh_directory_is_not_fetched_again(buyer_key: Ed25519Key) -> None:
+    server, now = Server([buyer_key]), [T0]
+    r = resolver(server, now)
+    assert resolve(r, buyer_key.thumbprint).public_key == buyer_key.public_key
+    now[0] = at(299)
+    assert resolve(r, buyer_key.thumbprint).public_key == buyer_key.public_key
+    assert server.fetches == 1
+
+
+def test_a_stale_directory_is_fetched_again_and_replaced(buyer_key: Ed25519Key) -> None:
+    server, now = Server([buyer_key]), [T0]
+    r = resolver(server, now)
+    resolve(r, buyer_key.thumbprint)
+    now[0] = at(300)
+    resolve(r, buyer_key.thumbprint)
+    assert server.fetches == 2
+
+
+def test_a_cached_directory_is_valid_until_its_earliest_expires(buyer_key: Ed25519Key) -> None:
+    server, now = Server([buyer_key]), [T0]
+    r = resolver(server, now)
+    resolve(r, buyer_key.thumbprint)
+    server.fail()
+    now[0] = at(86400)
+    assert (
+        resolve(r, buyer_key.thumbprint).public_key == buyer_key.public_key
+    )  # stale, still valid, and the refetch failed
+    now[0] = at(86401 + 60)
+    expect_refusal(lambda: resolve(r, buyer_key.thumbprint), Refusal.DIRECTORY_STATUS)
+
+
+def test_an_unknown_keyid_never_triggers_a_fetch_while_the_directory_is_fresh(
+    buyer_key: Ed25519Key,
+) -> None:
+    server, now = Server([buyer_key]), [T0]
+    r = resolver(server, now)
+    resolve(r, buyer_key.thumbprint)
+    for i in range(50):
+        expect_refusal(partial(resolve, r, KeyId(f"unknown-{i}")), Refusal.KEY_NOT_FOUND)
+    assert server.fetches == 1
+
+
+def _best_seconds(call: Callable[[], object], times: int) -> float:
+    """The fastest of five batches of ``times`` calls, per call, in seconds."""
+    best = float("inf")
+    for _ in range(5):
+        start = time.perf_counter()
+        for _ in range(times):
+            call()
+        best = min(best, (time.perf_counter() - start) / times)
+    return best
+
+
+def test_an_unknown_keyid_on_a_fresh_directory_costs_no_verification() -> None:
+    # A peer publishes the most keys a directory may hold, then sends random key ids.
+    keys = [Ed25519Key.generate() for _ in range(16)]
+    fetcher = Fetcher(keys)
+    r = Clocked(DirectoryResolver(fetcher, clock=lambda: T0), lambda: T0)
+    response = resolve(r, keys[0].thumbprint).directory
+    assert response is not None
+
+    def unknown() -> None:
+        expect_refusal(partial(resolve, r, KeyId("unknown")), Refusal.KEY_NOT_FOUND)
+
+    def verify() -> None:
+        verify_directory(response.evidence, BUYER_ORIGIN, T0)
+
+    # Verifying a 16-key directory checks 16 signatures; a cache hit checks none.
+    assert _best_seconds(unknown, 50) * 10 < _best_seconds(verify, 5)
+    assert fetcher.calls == 1
+
+
+def test_a_store_outside_the_process_is_verified_once_per_response(
+    buyer_key: Ed25519Key,
+) -> None:
+    keys = [buyer_key, *(Ed25519Key.generate() for _ in range(15))]
+    server, store = Server(keys), JsonStore()
+    r = over(server.transport(), store=store)
+    resolve(r, buyer_key.thumbprint)
+    stored = run(store.get(BUYER_ORIGIN))
+    assert stored is not None
+
+    def unknown() -> None:
+        expect_refusal(partial(resolve, r, KeyId("unknown")), Refusal.KEY_NOT_FOUND)
+
+    def verify() -> None:
+        verify_directory(stored, BUYER_ORIGIN, T0)
+
+    # The store hands back new objects of the bytes the resolver verified.
+    assert _best_seconds(unknown, 50) * 10 < _best_seconds(verify, 5)
+    assert server.fetches == 1
+
+
+def test_rotation_shows_once_the_cached_directory_is_stale(
+    buyer_key: Ed25519Key, other_key: Ed25519Key
+) -> None:
+    server, now = Server([buyer_key]), [T0]
+    r = resolver(server, now)
+    resolve(r, buyer_key.thumbprint)
+    server.serve([buyer_key, other_key])
+    expect_refusal(
+        lambda: resolve(r, other_key.thumbprint), Refusal.KEY_NOT_FOUND
+    )  # fresh: not fetched
+    now[0] = at(300)
+    assert resolve(r, other_key.thumbprint).public_key == other_key.public_key
+    server.serve([other_key], now=now[0])
+    now[0] = at(600)
+    expect_refusal(
+        lambda: resolve(r, buyer_key.thumbprint), Refusal.KEY_NOT_FOUND
+    )  # removed: evicted
+    assert resolve(r, other_key.thumbprint).public_key == other_key.public_key
+
+
+def test_a_failed_fetch_does_not_evict(buyer_key: Ed25519Key, other_key: Ed25519Key) -> None:
+    server, now = Server([buyer_key]), [T0]
+    r = resolver(server, now)
+    resolve(r, buyer_key.thumbprint)
+    server.fail()
+    now[0] = at(300)
+    assert resolve(r, buyer_key.thumbprint).public_key == buyer_key.public_key
+    expect_refusal(lambda: resolve(r, other_key.thumbprint), Refusal.KEY_NOT_FOUND)
+
+
+def test_a_failed_fetch_is_not_retried_for_60_seconds(buyer_key: Ed25519Key) -> None:
+    server, now = Server([buyer_key]), [T0]
+    server.fail(500)
+    r = resolver(server, now)
+    expect_refusal(lambda: resolve(r, buyer_key.thumbprint), Refusal.DIRECTORY_STATUS)
+    for i in range(20):
+        expect_refusal(partial(resolve, r, KeyId(f"fresh-{i}")), Refusal.DIRECTORY_UNAVAILABLE)
+    now[0] = at(59)
+    expect_refusal(lambda: resolve(r, buyer_key.thumbprint), Refusal.DIRECTORY_UNAVAILABLE)
+    assert server.fetches == 1
+    now[0] = at(60)
+    server.serve([buyer_key], now=now[0])
+    assert resolve(r, buyer_key.thumbprint).public_key == buyer_key.public_key
+    assert server.fetches == 2
+
+
+def test_the_store_is_bounded_and_drops_the_oldest_entry(buyer_key: Ed25519Key) -> None:
+    store = MemoryDirectoryStore(max_entries=2)
+    origins = [Origin.parse(f"https://a{i}.example.com") for i in range(5)]
+    for i, origin in enumerate(origins):
+        answer = w.signed_directory(origin, [buyer_key], now=at(i))
+        run(store.put(origin, w.fetched(*answer, origin=origin, now=at(i))))
+        run(store.record_failure(Origin.parse(f"https://b{i}.example.com"), at(i)))
+    kept = [o for o in origins if run(store.get(o)) is not None]
+    assert kept == origins[-2:]  # the oldest went first
+    failing = [
+        i for i in range(5) if run(store.failure_until(Origin.parse(f"https://b{i}.example.com")))
+    ]
+    assert failing == [3, 4]
+
+
+@pytest.mark.parametrize(
+    "make",
+    [MemoryDirectoryStore, lambda: MemoryDirectoryStore(max_entries=2)],
+    ids=["default", "bounded"],
+)
+def test_the_memory_store_keeps_the_directory_store_contract(
+    make: Callable[[], DirectoryStore],
+) -> None:
+    run(check_directory_store(make))
+
+
+class JsonStore:
+    """A store outside the process: it keeps each directory response as JSON text."""
+
+    def __init__(self) -> None:
+        self.rows: dict[str, str] = {}
+        self.failures: dict[str, UnixSeconds] = {}
+
+    async def get(self, origin: Origin) -> DirectoryResponse | None:
+        row = self.rows.get(str(origin))
+        if row is None:
+            return None
+        doc = json.loads(row)
+        lines = [(name, value) for name, value in doc["headers"]]
+        body = base64.b64decode(doc["body_base64"])
+        return DirectoryResponse(doc["url"], doc["status"], lines, body, doc["fetched_at"])
+
+    async def put(self, origin: Origin, response: DirectoryResponse) -> None:
+        self.rows[str(origin)] = json.dumps(response.document())
+
+    async def record_failure(self, origin: Origin, until: UnixSeconds) -> None:
+        self.failures[str(origin)] = until
+
+    async def failure_until(self, origin: Origin) -> UnixSeconds | None:
+        return self.failures.get(str(origin))
+
+
+def test_a_store_that_keeps_json_keeps_the_directory_store_contract() -> None:
+    run(check_directory_store(JsonStore))
+
+
+def test_a_store_outside_the_process_serves_the_resolver_with_plain_data(
+    buyer_key: Ed25519Key,
+) -> None:
+    # The directory's signatures last 30 s; the store keeps text and decides nothing.
+    server, clock = Server([buyer_key], policy=PublishPolicy(lifetime=30)), [T0]
+    store = JsonStore()
+    r = over(server.transport(), store=store, clock=lambda: clock[0])
+    verifier = w.request_verifier(resolver=r.resolver)
+    assert w.verify(verifier, w.signed_commit(buyer_key), now=T0).origin == BUYER_ORIGIN
+    clock[0] = at(100)  # the stored directory expired at at(30)
+    server.serve([buyer_key], now=at(100), policy=PublishPolicy(lifetime=30))
+    later = w.signed_commit(buyer_key, now=at(100))
+    assert w.verify(verifier, later, now=at(100)).origin == BUYER_ORIGIN
+    assert server.fetches == 2
+    again = w.signed_commit(buyer_key, now=at(101))
+    assert w.verify(verifier, again, now=at(101)).origin == BUYER_ORIGIN
+    assert server.fetches == 2  # answered from the stored text, verified again
+
+
+def test_a_stored_response_that_does_not_verify_is_a_cache_miss(buyer_key: Ed25519Key) -> None:
+    server, clock, store = Server([buyer_key]), [T0], JsonStore()
+    r = over(server.transport(), store=store, clock=lambda: clock[0])
+    resolve(r, buyer_key.thumbprint)
+    row = json.loads(store.rows[BUYER])
+    row["body_base64"] = base64.b64encode(b'{"keys": []}').decode()
+    store.rows[BUYER] = json.dumps(row)
+    clock[0] = at(10)
+    assert resolve(r, buyer_key.thumbprint).public_key == buyer_key.public_key
+    assert server.fetches == 2
+    stored = run(store.get(BUYER_ORIGIN))
+    assert stored is not None and stored.body == server.body  # the refetch replaced it
+
+
+def test_the_memory_nonce_store_keeps_the_nonce_store_contract() -> None:
+    run(check_nonce_store(lambda clock: MemoryNonceStore(clock=clock)))
+
+
+def test_a_stored_directory_answers_only_until_it_expires(buyer_key: Ed25519Key) -> None:
+    # The store keeps the directory whatever the time; the resolver checks expires.
+    server, now = Server([buyer_key]), [T0]
+    r = resolver(server, now)
+    assert resolve(r, buyer_key.thumbprint).directory is not None
+    server.fail()
+    now[0] = at(7 * 86400)
+    expect_refusal(lambda: resolve(r, buyer_key.thumbprint), Refusal.DIRECTORY_STATUS)
+
+
+class Down(MemoryDirectoryStore):
+    """A store whose backend is down for the methods it names, as Redis is in an outage."""
+
+    def __init__(self, *down: str) -> None:
+        super().__init__()
+        self.down = frozenset(down)
+
+    def _reach(self, method: str) -> None:
+        if method in self.down:
+            raise DirectoryStoreUnavailable(f"redis at 10.0.0.5:6379 refused {method}")
+
+    async def get(self, origin: Origin) -> DirectoryResponse | None:
+        self._reach("get")
+        return await super().get(origin)
+
+    async def put(self, origin: Origin, response: DirectoryResponse) -> None:
+        self._reach("put")
+        await super().put(origin, response)
+
+    async def record_failure(self, origin: Origin, until: UnixSeconds) -> None:
+        self._reach("record_failure")
+        await super().record_failure(origin, until)
+
+    async def failure_until(self, origin: Origin) -> UnixSeconds | None:
+        self._reach("failure_until")
+        return await super().failure_until(origin)
+
+
+_EVERY_METHOD = ("get", "put", "record_failure", "failure_until")
+
+
+def test_a_store_that_cant_be_read_is_a_miss_and_the_directory_is_fetched(
+    buyer_key: Ed25519Key, caplog: pytest.LogCaptureFixture
+) -> None:
+    server = Server([buyer_key])
+    r = over(server.transport(), store=Down(*_EVERY_METHOD))
+    for _ in range(2):
+        assert resolve(r, buyer_key.thumbprint).public_key == buyer_key.public_key
+    assert server.fetches == 2  # nothing could be kept, so each resolve fetches
+    assert "can't be read" in caplog.text and "can't be written" in caplog.text
+
+
+def test_a_store_that_cant_record_a_failure_keeps_the_refusal(buyer_key: Ed25519Key) -> None:
+    server = Server([buyer_key])
+    server.fail(500)
+    r = over(server.transport(), store=Down("record_failure", "failure_until"))
+    for _ in range(2):
+        expect_refusal(lambda: resolve(r, buyer_key.thumbprint), Refusal.DIRECTORY_STATUS)
+    assert server.fetches == 2  # no failure deadline could be kept
+
+
+def test_a_store_that_comes_back_is_used_again(buyer_key: Ed25519Key) -> None:
+    server, store = Server([buyer_key]), Down(*_EVERY_METHOD)
+    r = over(server.transport(), store=store)
+    resolve(r, buyer_key.thumbprint)
+    store.down = frozenset()
+    resolve(r, buyer_key.thumbprint)
+    resolve(r, buyer_key.thumbprint)
+    assert server.fetches == 2  # the second fetch was kept, and the third resolve read it
+
+
+def test_a_verifier_over_a_store_that_is_down_answers_with_the_profiles_outcome(
+    buyer_key: Ed25519Key,
+) -> None:
+    served = w.directory_transport_for({BUYER: [buyer_key]})
+    verifier = w.request_verifier(resolver=over(served, store=Down(*_EVERY_METHOD)).resolver)
+    assert run(verifier.verify(w.sign_request())).origin == BUYER_ORIGIN
+    failing = Server([buyer_key])
+    failing.fail(503)
+    nowhere = over(failing.transport(), store=Down(*_EVERY_METHOD))
+    refusing = w.request_verifier(resolver=nowhere.resolver)
+    expect_refusal(lambda: refusing.verify(w.sign_request()), Refusal.DIRECTORY_STATUS)
+
+
+def test_any_other_store_error_is_a_bug_that_propagates(buyer_key: Ed25519Key) -> None:
+    class Broken(MemoryDirectoryStore):
+        async def get(self, origin: Origin) -> DirectoryResponse | None:
+            raise ConnectionError("not a DirectoryStoreUnavailable")
+
+    r = over(Server([buyer_key]).transport(), store=Broken())
+    with pytest.raises(ConnectionError):
+        resolve(r, buyer_key.thumbprint)
+
+
+class Lying(MemoryDirectoryStore):
+    """A store that answers every origin with the buyer's directory once it holds it."""
+
+    async def get(self, origin: Origin) -> DirectoryResponse | None:
+        return await super().get(BUYER_ORIGIN)
+
+
+def test_a_store_answering_for_another_origin_is_not_believed(
+    buyer_key: Ed25519Key, other_key: Ed25519Key
+) -> None:
+    served = w.directory_transport_for({BUYER: [buyer_key], w.OTHER: [other_key]})
+    r = over(served, store=Lying())
+    assert resolve(r, buyer_key.thumbprint).directory is not None
+    # The store offers the buyer's directory for the other origin; the resolver
+    # fetches the other origin's own, and the buyer's key isn't in it.
+    expect_refusal(lambda: resolve(r, buyer_key.thumbprint, w.OTHER_ORIGIN), Refusal.KEY_NOT_FOUND)
+
+
+def test_a_blocked_address_is_a_failed_fetch_held_back_for_the_negative_ttl(
+    buyer_key: Ed25519Key,
+) -> None:
+    calls = []
+
+    def guard(request: httpx.Request) -> httpx.Response:
+        calls.append(request.url)
+        raise BlockedAddress("the deployment doesn't fetch from this address", request=request)
+
+    now = [T0]
+    r = over(httpx.MockTransport(guard), clock=lambda: now[0])
+    for _ in range(3):
+        expect_refusal(lambda: resolve(r, buyer_key.thumbprint), Refusal.DIRECTORY_UNAVAILABLE)
+    assert len(calls) == 1
+    now[0] = at(60)
+    expect_refusal(lambda: resolve(r, buyer_key.thumbprint), Refusal.DIRECTORY_UNAVAILABLE)
+    assert len(calls) == 2
+
+
+def test_negative_entries_cover_failed_fetches(buyer_key: Ed25519Key) -> None:
+    server, now = Server([buyer_key]), [T0]
+    server.fail(500)
+    r = resolver(server, now)
+    expect_refusal(lambda: resolve(r, buyer_key.thumbprint), Refusal.DIRECTORY_STATUS)
+    expect_refusal(lambda: resolve(r, buyer_key.thumbprint), Refusal.DIRECTORY_UNAVAILABLE)
+    assert server.fetches == 1
+
+
+def test_a_store_is_shared_and_clearable(buyer_key: Ed25519Key) -> None:
+    store = MemoryDirectoryStore()
+    server = Server([buyer_key])
+    one, two = over(server.transport(), store=store), over(server.transport(), store=store)
+    resolve(one, buyer_key.thumbprint)
+    resolve(two, buyer_key.thumbprint)
+    assert server.fetches == 1
+    store.clear()
+    resolve(two, buyer_key.thumbprint)
+    assert server.fetches == 2
+
+
+def test_a_verify_judged_later_neither_stamps_nor_pins_the_cache(
+    buyer_key: Ed25519Key, other_key: Ed25519Key
+) -> None:
+    server, clock = Server([buyer_key]), [T0]
+    r = over(server.transport(), clock=lambda: clock[0])
+    verifier = w.request_verifier(resolver=r.resolver)
+    ahead = w.signed_commit(buyer_key, now=at(3600))
+    assert w.verify(verifier, ahead, now=at(3600)).origin == BUYER_ORIGIN  # fetched at T0
+    server.serve([other_key], now=at(400))  # the buyer rotates its key out
+    clock[0] = at(400)
+    rotated = w.signed_commit(buyer_key, now=at(400))
+    expect_refusal(lambda: w.verify(verifier, rotated, now=at(400)), Refusal.KEY_NOT_FOUND)
+    assert server.fetches == 2
+
+
+def test_a_failure_judged_later_is_held_back_on_the_resolvers_clock(
+    buyer_key: Ed25519Key,
+) -> None:
+    server, clock = Server([buyer_key]), [T0]
+    server.fail(500)
+    r = over(server.transport(), clock=lambda: clock[0])
+    verifier = w.request_verifier(resolver=r.resolver)
+    ahead = w.signed_commit(buyer_key, now=at(3600))
+    expect_refusal(lambda: w.verify(verifier, ahead, now=at(3600)), Refusal.DIRECTORY_STATUS)
+    clock[0] = at(60)
+    server.serve([buyer_key])
+    retried = w.signed_commit(buyer_key, now=at(60))
+    assert w.verify(verifier, retried, now=at(60)).origin == BUYER_ORIGIN
+    assert server.fetches == 2
+
+
+def test_the_callers_time_judges_the_directorys_expiry(buyer_key: Ed25519Key) -> None:
+    server = Server([buyer_key])  # its signatures expire at at(86400)
+    r = over(server.transport())
+    verifier = w.request_verifier(resolver=r.resolver)
+    late = w.signed_commit(buyer_key, now=at(86401))
+    expect_refusal(lambda: w.verify(verifier, late, now=at(86401)), Refusal.DIRECTORY_WINDOW)
+    assert server.fetches == 1
+
+
+def test_max_cache_age_and_negative_ttl_are_the_resolvers(buyer_key: Ed25519Key) -> None:
+    server, now = Server([buyer_key]), [T0]
+    r = over(
+        server.transport(),
+        cache=CachePolicy(max_cache_age=10, negative_ttl=5),
+        clock=lambda: now[0],
+    )
+    resolve(r, buyer_key.thumbprint)
+    now[0] = at(10)
+    resolve(r, buyer_key.thumbprint)
+    assert server.fetches == 2
+    server.fail()
+    now[0] = at(20)
+    resolve(r, buyer_key.thumbprint)  # the refetch failed; the stored keys answer
+    now[0] = at(25)
+    resolve(r, buyer_key.thumbprint)
+    assert server.fetches == 4
+
+
+# ── one fetch per origin, and only refusals are failures ──────────────────
+
+
+def test_fifty_concurrent_cold_resolves_make_one_fetch(buyer_key: Ed25519Key) -> None:
+    fetcher = Fetcher([buyer_key], delay=0.01)
+    r = Clocked(DirectoryResolver(fetcher, clock=lambda: T0), lambda: T0)
+
+    async def go() -> list[ResolvedKey]:
+        return await asyncio.gather(
+            *(r.resolve(BUYER_ORIGIN, buyer_key.thumbprint) for _ in range(50))
+        )
+
+    resolved = run(go())
+    assert fetcher.calls == 1
+    assert len({id(k.directory) for k in resolved}) == 1
+
+
+def test_concurrent_resolves_share_one_refusal(buyer_key: Ed25519Key) -> None:
+    fetcher = Fetcher([buyer_key], delay=0.01)
+    fetcher.status = 500
+    r = Clocked(DirectoryResolver(fetcher, clock=lambda: T0), lambda: T0)
+
+    async def go() -> list[ResolvedKey | BaseException]:
+        return await asyncio.gather(
+            *(r.resolve(BUYER_ORIGIN, buyer_key.thumbprint) for _ in range(10)),
+            return_exceptions=True,
+        )
+
+    results = run(go())
+    assert fetcher.calls == 1
+    errors = [e for e in results if isinstance(e, WebBotAuthError)]
+    assert len(errors) == len(results)
+    assert {e.reason for e in errors} == {"directory-status"}
+
+
+def test_an_unexpected_error_in_the_fetcher_propagates_and_records_nothing(
+    buyer_key: Ed25519Key,
+) -> None:
+    store = MemoryDirectoryStore()
+    fetcher = Fetcher([buyer_key], error=RuntimeError("Event loop is closed"))
+    r = Clocked(DirectoryResolver(fetcher, store, clock=lambda: T0), lambda: T0)
+    with pytest.raises(RuntimeError, match="Event loop is closed"):
+        resolve(r, buyer_key.thumbprint)
+    assert run(store.failure_until(BUYER_ORIGIN)) is None
+    fetcher.error = None
+    assert (
+        resolve(r, buyer_key.thumbprint).public_key == buyer_key.public_key
+    )  # not held back by a negative entry
+    assert fetcher.calls == 2
+
+
+@pytest.mark.parametrize("error", [TypeError("bug"), AttributeError("bug"), RecursionError("deep")])
+def test_no_defect_becomes_directory_unavailable(buyer_key: Ed25519Key, error: Exception) -> None:
+    r = Clocked(DirectoryResolver(Fetcher([buyer_key], error=error), clock=lambda: T0), lambda: T0)
+    with pytest.raises(type(error)):
+        resolve(r, buyer_key.thumbprint)
+
+
+# ── fetch rules ───────────────────────────────────────────────────────────
+
+
+def test_only_https_origins_can_be_resolved() -> None:
+    # The resolver takes an Origin, and an Origin is https://<host> by construction.
+    with pytest.raises(ConfigurationError):
+        Origin.parse("http://buyer.example.com")
+
+
+def test_redirects_are_not_followed(buyer_key: Ed25519Key) -> None:
+    def handler(request: httpx.Request) -> httpx.Response:
+        if request.url.path == DIRECTORY_PATH:
+            return httpx.Response(
+                302,
+                headers={"Location": "https://other.example.com" + DIRECTORY_PATH},
+                stream=httpx.ByteStream(b""),
+            )
+        raise AssertionError("followed a redirect")
+
+    expect_refusal(
+        lambda: resolve(over(httpx.MockTransport(handler)), buyer_key.thumbprint),
+        Refusal.DIRECTORY_STATUS,
+    )
+
+
+def test_media_type_is_checked_on_fetch(buyer_key: Ed25519Key) -> None:
+    server, now = Server([buyer_key]), [T0]
+    server.headers["Content-Type"] = "application/json"
+    expect_refusal(
+        lambda: resolve(resolver(server, now), buyer_key.thumbprint), Refusal.DIRECTORY_MEDIA_TYPE
+    )
+
+
+def test_the_body_cap_applies_to_the_served_bytes(buyer_key: Ed25519Key) -> None:
+    server, now = Server([buyer_key]), [T0]
+    expect_refusal(
+        lambda: resolve(resolver(server, now, max_bytes=100), buyer_key.thumbprint),
+        Refusal.DIRECTORY_TOO_LARGE,
+    )
+
+
+def test_the_streamed_read_stops_one_byte_past_the_cap(buyer_key: Ed25519Key) -> None:
+    served: list[int] = []
+
+    class Chunks(httpx.AsyncByteStream):
+        async def __aiter__(self) -> AsyncIterator[bytes]:
+            for _ in range(300):
+                served.append(1)
+                yield b" " * 1024
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        return httpx.Response(
+            200,
+            headers={"Content-Type": "application/http-message-signatures-directory+json"},
+            stream=Chunks(),
+        )
+
+    expect_refusal(
+        lambda: resolve(over(httpx.MockTransport(handler)), buyer_key.thumbprint),
+        Refusal.DIRECTORY_TOO_LARGE,
+    )
+    assert len(served) == 257  # 256 KiB, then the chunk that crosses the cap
+
+
+def test_the_testing_transport_runs_the_streamed_capped_read(buyer_key: Ed25519Key) -> None:
+    status, lines, body = w.signed_directory(BUYER, [buyer_key])
+    headers = dict(lines.items())
+    transport = directory_transport({BUYER_ORIGIN: Answer(status, HeaderLines(headers), body)})
+    assert resolve(over(transport), buyer_key.thumbprint).public_key == buyer_key.public_key
+    capped = over(transport, limits=FetchLimits(max_bytes=len(body) - 1))
+    expect_refusal(lambda: resolve(capped, buyer_key.thumbprint), Refusal.DIRECTORY_TOO_LARGE)
+
+
+def test_key_count_cap_on_fetch(buyer_key: Ed25519Key, other_key: Ed25519Key) -> None:
+    server, now = Server([buyer_key, other_key]), [T0]
+    expect_refusal(
+        lambda: resolve(resolver(server, now, max_keys=1), buyer_key.thumbprint),
+        Refusal.DIRECTORY_TOO_MANY_KEYS,
+    )
+
+
+def test_total_timeout(buyer_key: Ed25519Key) -> None:
+    class Slow(httpx.AsyncBaseTransport):
+        async def handle_async_request(self, request: httpx.Request) -> httpx.Response:
+            await asyncio.sleep(5)
+            raise AssertionError("not reached")
+
+    slow = over(Slow(), limits=FetchLimits(total_timeout=0.05))
+    error = expect_refusal(
+        lambda: resolve(slow, buyer_key.thumbprint), Refusal.DIRECTORY_UNAVAILABLE
+    )
+    assert "timed out" in str(error)
+
+
+def test_transport_errors_are_403(buyer_key: Ed25519Key) -> None:
+    def handler(request: httpx.Request) -> httpx.Response:
+        raise httpx.ConnectError("refused")
+
+    expect_refusal(
+        lambda: resolve(over(httpx.MockTransport(handler)), buyer_key.thumbprint),
+        Refusal.DIRECTORY_UNAVAILABLE,
+    )
+
+
+def test_defaults_match_the_profile() -> None:
+    policy = FetchLimits()
+    assert (policy.connect_timeout, policy.total_timeout) == (5.0, 10.0)
+    assert (policy.max_bytes, policy.max_keys) == (256 * 1024, 16)
+    cache = CachePolicy()
+    assert (cache.max_cache_age, cache.negative_ttl) == (300, 60)
+
+
+# ── the injected client, the owned client, and TLS ────────────────────────
+
+
+def test_an_injected_client_carries_every_fetch_and_stays_open(buyer_key: Ed25519Key) -> None:
+    server = Server([buyer_key])
+
+    async def go() -> bool:
+        async with httpx.AsyncClient(transport=server.transport()) as client:
+            async with DirectoryResolver(HttpxDirectoryFetcher(client), clock=lambda: T0) as r:
+                await r.resolve(BUYER_ORIGIN, buyer_key.thumbprint, now=T0)
+            async with HttpxDirectoryFetcher(client):
+                pass
+            return client.is_closed
+
+    assert run(go()) is False and server.fetches == 1
+
+
+def test_a_callers_transport_stays_open_after_aclose(buyer_key: Ed25519Key) -> None:
+    class Counting(httpx.AsyncBaseTransport):
+        closed = 0
+
+        def __init__(self, inner: httpx.AsyncBaseTransport) -> None:
+            self.inner = inner
+
+        async def handle_async_request(self, request: httpx.Request) -> httpx.Response:
+            return await self.inner.handle_async_request(request)
+
+        async def aclose(self) -> None:
+            self.closed += 1
+
+    transport = Counting(Server([buyer_key]).transport())
+
+    async def go() -> None:
+        fetcher = HttpxDirectoryFetcher(transport=transport)
+        r = DirectoryResolver(fetcher, clock=lambda: T0)
+        await r.resolve(BUYER_ORIGIN, buyer_key.thumbprint, now=T0)
+        await r.aclose()
+        await fetcher.aclose()
+
+    run(go())
+    assert transport.closed == 0
+
+
+def test_the_resolver_closes_the_fetcher_it_built(buyer_key: Ed25519Key) -> None:
+    async def go() -> None:
+        async with DirectoryResolver() as r:
+            pass
+        await r.resolve(BUYER_ORIGIN, buyer_key.thumbprint, now=T0)
+
+    with pytest.raises(ConfigurationError, match="closed"):
+        run(go())
+
+
+def test_the_profile_rules_apply_on_an_injected_client_that_follows_redirects(
+    buyer_key: Ed25519Key,
+) -> None:
+    def handler(request: httpx.Request) -> httpx.Response:
+        if request.url.host == "buyer.example.com":
+            return httpx.Response(
+                307,
+                headers={"Location": "https://other.example.com" + DIRECTORY_PATH},
+                stream=httpx.ByteStream(b""),
+            )
+        raise AssertionError("followed a redirect")
+
+    async def go() -> ResolvedKey:
+        async with httpx.AsyncClient(
+            transport=httpx.MockTransport(handler), follow_redirects=True
+        ) as c:
+            return await Clocked(
+                DirectoryResolver(HttpxDirectoryFetcher(c), clock=lambda: T0), lambda: T0
+            ).resolve(BUYER_ORIGIN, buyer_key.thumbprint)
+
+    assert "redirects" in str(expect_refusal(go, Refusal.DIRECTORY_STATUS))
+
+
+def test_the_library_adds_no_address_policy(buyer_key: Ed25519Key) -> None:
+    # A plain client reaches whatever it reaches; address policy belongs to the client.
+    seen: list[str] = []
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        seen.append(str(request.url))
+        return httpx.Response(404, stream=httpx.ByteStream(b""))
+
+    async def go() -> None:
+        async with httpx.AsyncClient(transport=httpx.MockTransport(handler)) as c:
+            await Clocked(
+                DirectoryResolver(HttpxDirectoryFetcher(c), clock=lambda: T0), lambda: T0
+            ).resolve(Origin.parse("https://127.0.0.1"), buyer_key.thumbprint)
+
+    expect_refusal(go, Refusal.DIRECTORY_STATUS)
+    assert seen == ["https://127.0.0.1" + DIRECTORY_PATH]
+
+
+class FetcherOptions(TypedDict, total=False):
+    """What an injected client can't be combined with."""
+
+    tls: TLSConfig
+    transport: httpx.AsyncBaseTransport
+
+
+@pytest.mark.parametrize(
+    "options",
+    [
+        {"tls": TLSConfig(ca_bundle="/certs/ca.pem")},
+        {"tls": TLSConfig(extra_ca="/certs/ca.pem")},
+        {"transport": httpx.MockTransport(lambda r: httpx.Response(404))},
+    ],
+)
+def test_tls_or_a_transport_with_an_injected_client_is_a_configuration_error(
+    options: FetcherOptions,
+) -> None:
+    with pytest.raises(ConfigurationError):
+        HttpxDirectoryFetcher(httpx.AsyncClient(), **options)
+
+
+def test_tls_with_a_transport_is_a_configuration_error() -> None:
+    with pytest.raises(ConfigurationError):
+        HttpxDirectoryFetcher(
+            tls=TLSConfig(ca_bundle="/certs/ca.pem"),
+            transport=httpx.MockTransport(lambda r: httpx.Response(404)),
+        )
+
+
+def test_ca_bundle_replaces_and_extra_ca_adds_trust_anchors(tmp_path: Path) -> None:
+    with pytest.raises(FileNotFoundError):
+        HttpxDirectoryFetcher(tls=TLSConfig(ca_bundle=str(tmp_path / "missing.pem")))
+    with pytest.raises(FileNotFoundError):
+        TLSConfig(extra_ca=str(tmp_path / "missing.pem")).ssl_context()
+    system = TLSConfig().ssl_context()
+    assert system.verify_mode.name == "CERT_REQUIRED"
+    pem = _self_signed_ca(tmp_path)
+    extra = TLSConfig(extra_ca=str(pem)).ssl_context()
+    assert extra.cert_store_stats()["x509_ca"] == system.cert_store_stats()["x509_ca"] + 1
+    only = TLSConfig(ca_bundle=str(pem)).ssl_context()
+    assert only.cert_store_stats()["x509_ca"] == 1
+
+
+def _self_signed_ca(tmp_path: Path) -> Path:
+    import datetime
+
+    from cryptography import x509
+    from cryptography.hazmat.primitives import hashes, serialization
+    from cryptography.hazmat.primitives.asymmetric import ec
+    from cryptography.x509.oid import NameOID
+
+    key = ec.generate_private_key(ec.SECP256R1())
+    name = x509.Name([x509.NameAttribute(NameOID.COMMON_NAME, "aamp test CA")])
+    now = datetime.datetime.now(datetime.UTC)
+    cert = (
+        x509.CertificateBuilder()
+        .subject_name(name)
+        .issuer_name(name)
+        .public_key(key.public_key())
+        .serial_number(1)
+        .not_valid_before(now)
+        .not_valid_after(now + datetime.timedelta(days=1))
+        .add_extension(x509.BasicConstraints(ca=True, path_length=None), critical=True)
+        .sign(key, hashes.SHA256())
+    )
+    path = tmp_path / "ca.pem"
+    path.write_bytes(cert.public_bytes(serialization.Encoding.PEM))
+    return path
+
+
+# ── other resolvers ───────────────────────────────────────────────────────
+
+
+def test_static_key_resolver_accepts_keys_public_keys_and_jwks(
+    buyer_key: Ed25519Key, other_key: Ed25519Key, seller_key: Ed25519Key
+) -> None:
+    r = StaticKeyResolver({BUYER: [buyer_key, other_key.public_key, seller_key.public_jwk()]})
+    for key in (buyer_key, other_key, seller_key):
+        assert run(r.resolve(BUYER_ORIGIN, key.thumbprint, now=T0)).public_key == key.public_key
+    expect_refusal(
+        lambda: r.resolve(w.OTHER_ORIGIN, buyer_key.thumbprint, now=T0), Refusal.KEY_NOT_FOUND
+    )
+    with pytest.raises(ValueError, match="32 bytes"):
+        StaticKeyResolver({BUYER: [{"kty": "OKP", "crv": "Ed25519", "x": "AAAA"}]})
+
+
+def test_static_key_resolver_takes_a_verified_directorys_keys(buyer_key: Ed25519Key) -> None:
+    directory = verify_directory(
+        w.fetched(*w.signed_directory(BUYER, [buyer_key])), BUYER_ORIGIN, T0
+    )
+    r = StaticKeyResolver({BUYER_ORIGIN: directory.keys})
+    assert run(r.resolve(BUYER_ORIGIN, buyer_key.thumbprint, now=T0)).public_key is not None
+
+
+def test_verifying_through_pinned_keys_loads_no_network_client() -> None:
+    program = f"""
+import asyncio, sys
+from iab_agentic_primitives.web_bot_auth import (
+    Ed25519Key, HTTPRequest, MemoryNonceStore, RequestSigner, RequestVerifier,
+    ServerIdentity, StaticKeyResolver,
+)
+key = Ed25519Key.generate()
+signed = RequestSigner.of(key, {BUYER!r}).sign(HTTPRequest("GET", "https://seller.example.com/x"))
+verifier = RequestVerifier(
+    StaticKeyResolver({{{BUYER!r}: [key]}}),
+    identity=ServerIdentity.from_config("https://seller.example.com"),
+    nonces=MemoryNonceStore(),
+)
+assert str(asyncio.run(verifier.verify(signed)).origin) == {BUYER!r}
+assert "httpx" not in sys.modules, "httpx was imported"
+"""
+    done = subprocess.run([sys.executable, "-c", program], capture_output=True, text=True)
+    assert done.returncode == 0, done.stderr
+
+
+def test_directory_transport_serves_only_the_well_known_path(buyer_key: Ed25519Key) -> None:
+    transport = directory_transport({BUYER_ORIGIN: w.signed_directory(BUYER, [buyer_key])})
+    with httpx.Client(transport=transport) as client:
+        assert client.get(BUYER + DIRECTORY_PATH).status_code == 200
+        assert client.get(BUYER + "/other").status_code == 404
+        assert client.get(w.OTHER + DIRECTORY_PATH).status_code == 404
+
+
+# ── directory evidence ────────────────────────────────────────────────────
+
+
+def test_the_verified_directory_carries_the_response_it_was_verified_from(
+    buyer_key: Ed25519Key,
+) -> None:
+    status, lines, body = w.signed_directory(BUYER, [buyer_key])
+    headers = dict(lines.items())
+    r = over(
+        directory_transport({BUYER_ORIGIN: Answer(status, HeaderLines(headers), body)}),
+        clock=lambda: at(5),
+    )
+    resolved = run(r.resolve(BUYER_ORIGIN, buyer_key.thumbprint))
+    directory = resolved.directory
+    assert directory is not None
+    assert resolved.public_key == directory.key(buyer_key.thumbprint)
+    evidence = directory.evidence
+    assert evidence.url == BUYER + DIRECTORY_PATH
+    assert evidence.status == 200 and evidence.body == body and evidence.fetched_at == at(5)
+    names = {name.lower() for name, _ in evidence.headers}
+    assert {"signature-input", "signature", "content-digest", "content-type"} <= names
+    # The evidence verifies again on its own.
+    again = verify_directory(evidence, BUYER_ORIGIN, T0)
+    assert list(again.keys) == [buyer_key.thumbprint]
+    assert json.loads(json.dumps(evidence.document()))["body"] == body.decode()
+    # A cache hit verifies the same evidence again.
+    hit = run(r.resolve(BUYER_ORIGIN, buyer_key.thumbprint)).directory
+    assert hit is not None and hit.evidence == evidence
+
+
+def test_evidence_is_the_bytes_read_under_the_cap(buyer_key: Ed25519Key) -> None:
+    status, lines, body = w.signed_directory(BUYER, [buyer_key])
+    headers = dict(lines.items())
+
+    class Chunks(httpx.AsyncByteStream):
+        async def __aiter__(self) -> AsyncIterator[bytes]:
+            for i in range(0, len(body), 7):
+                yield body[i : i + 7]
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        return httpx.Response(status, headers=headers, stream=Chunks())
+
+    directory = run(over(httpx.MockTransport(handler)).resolve(BUYER_ORIGIN, buyer_key.thumbprint))
+    assert directory.directory is not None
+    assert directory.directory.evidence.body == body
+
+
+def test_verified_signatures_reach_their_directory(
+    buyer_key: Ed25519Key, seller_key: Ed25519Key
+) -> None:
+    verifier = w.request_verifier()
+    result = w.verify(verifier, w.signed_commit(buyer_key))
+    assert result.directory is not None
+    assert result.directory.evidence.url == BUYER + DIRECTORY_PATH
+    assert buyer_key.thumbprint in result.directory.keys
+    request, headers = w.signed_result(seller_key, w.signed_commit(buyer_key))
+    response = run(
+        w.response_verifier().verify(HTTPResponse(200, headers, w.COMMIT_RESULT_BODY, request))
+    )
+    assert response.directory is not None
+    assert response.directory.evidence.url == w.SELLER + DIRECTORY_PATH
+
+
+def test_a_resolver_without_directories_leaves_it_empty(buyer_key: Ed25519Key) -> None:
+    verifier = RequestVerifier(
+        StaticKeyResolver({BUYER: [buyer_key]}),
+        identity=SELLER_IDENTITY,
+        nonces=MemoryNonceStore(clock=lambda: T0),
+        clock=lambda: T0,
+        keys=CONFORMANCE_KEYS,
+    )
+    assert w.verify(verifier, w.signed_commit(buyer_key)).directory is None
+
+
+@pytest.mark.parametrize("encoding", ["gzip", "br", "deflate"])
+def test_a_directory_with_a_content_encoding_is_refused(
+    buyer_key: Ed25519Key, encoding: str
+) -> None:
+    server, now = Server([buyer_key]), [T0]
+    server.headers["Content-Encoding"] = encoding
+    expect_refusal(
+        lambda: resolve(resolver(server, now), buyer_key.thumbprint), Refusal.DIRECTORY_ENCODING
+    )
+
+
+def test_the_cap_and_the_evidence_apply_to_the_bytes_on_the_wire(buyer_key: Ed25519Key) -> None:
+    status, lines, body = w.signed_directory(BUYER, [buyer_key])
+    headers = dict(lines.items())
+    seen: list[str] = []
+
+    class Raw(httpx.AsyncByteStream):
+        async def __aiter__(self) -> AsyncIterator[bytes]:
+            seen.append("raw")
+            yield body
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        return httpx.Response(
+            status, headers={**headers, "Content-Encoding": "identity"}, stream=Raw()
+        )
+
+    resolved = run(over(httpx.MockTransport(handler)).resolve(BUYER_ORIGIN, buyer_key.thumbprint))
+    assert resolved.directory is not None
+    assert resolved.directory.evidence.body == body and seen == ["raw"]
+
+
+def test_a_client_error_becomes_a_403_and_is_cached(buyer_key: Ed25519Key) -> None:
+    calls: list[int] = []
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        calls.append(1)
+        raise httpx.InvalidURL("Invalid IPv4 address")
+
+    r = over(httpx.MockTransport(handler))
+    expect_refusal(lambda: resolve(r, buyer_key.thumbprint), Refusal.DIRECTORY_UNAVAILABLE)
+    expect_refusal(lambda: resolve(r, buyer_key.thumbprint), Refusal.DIRECTORY_UNAVAILABLE)
+    assert len(calls) == 1
+
+
+def test_the_cache_uses_the_same_expires_boundary(buyer_key: Ed25519Key) -> None:
+    server, now = Server([buyer_key], now=at(-86400 + 100)), [T0]  # expires at at(100)
+    r = resolver(server, now)
+    now[0] = at(99)
+    resolve(r, buyer_key.thumbprint)
+    server.fail()
+    now[0] = at(100)  # stale, still valid at the boundary second; the failed refetch doesn't evict
+    assert resolve(r, buyer_key.thumbprint).public_key == buyer_key.public_key
+    now[0] = at(101 + 60)
+    expect_refusal(lambda: resolve(r, buyer_key.thumbprint), Refusal.DIRECTORY_STATUS)
+
+
+def test_a_fetcher_answering_from_another_origins_url_is_refused(buyer_key: Ed25519Key) -> None:
+    # The evidence must name the origin it is attributed to.
+    class Elsewhere(Fetcher):
+        async def fetch(
+            self, origin: Origin, *, limits: FetchLimits, now: UnixSeconds
+        ) -> DirectoryResponse:
+            fetched = await super().fetch(origin, limits=limits, now=now)
+            other = Origin.parse("https://other.example.com")
+            return DirectoryResponse(
+                other.directory_url, fetched.status, fetched.headers, fetched.body, now
+            )
+
+    r = Clocked(DirectoryResolver(Elsewhere([buyer_key]), clock=lambda: T0), lambda: T0)
+    expect_refusal(
+        lambda: r.resolve(BUYER_ORIGIN, buyer_key.thumbprint), Refusal.DIRECTORY_UNAVAILABLE
+    )
diff --git a/tests/web_bot_auth/test_wba_response.py b/tests/web_bot_auth/test_wba_response.py
new file mode 100644
index 0000000..83944b6
--- /dev/null
+++ b/tests/web_bot_auth/test_wba_response.py
@@ -0,0 +1,221 @@
+"""ResponseSigner and ResponseVerifier: components, the request binding, and refusals."""
+
+from __future__ import annotations
+
+import pytest
+
+from iab_agentic_primitives.web_bot_auth import (
+    Ed25519Key,
+    HTTPRequest,
+    HTTPResponse,
+    Origin,
+    Refusal,
+    RequestSigner,
+    ResponseSigner,
+    ResponseVerifier,
+    VerifiedResponse,
+)
+from iab_agentic_primitives.web_bot_auth.conformance import scenarios_document
+from iab_agentic_primitives.web_bot_auth.conformance.models import Refuses, ResponseScenario
+from iab_agentic_primitives.web_bot_auth.conformance.signing import (
+    MessageDeparture,
+    sign_response_scenario,
+)
+from iab_agentic_primitives.web_bot_auth.signer import SignerConfig
+from iab_agentic_primitives.web_bot_auth.sync import SyncResponseVerifier, SyncRuntime
+from iab_agentic_primitives.web_bot_auth.values import OMIT
+
+from . import support as w
+from .support import (
+    COMMIT_RESULT_BODY,
+    JSON,
+    SELLER,
+    SELLER_ORIGIN,
+    T0,
+    expect_refusal,
+    run,
+    signed_commit,
+    signed_result,
+)
+
+
+def verify(
+    response_verifier: ResponseVerifier,
+    response: HTTPResponse,
+    *,
+    expected_origin: Origin | None = None,
+) -> VerifiedResponse:
+    return run(response_verifier.verify(response, expected_origin=expected_origin))
+
+
+def test_signed_response_is_bound_to_the_signed_request(
+    response_verifier: ResponseVerifier, buyer_key: Ed25519Key, seller_key: Ed25519Key
+) -> None:
+    request, headers = signed_result(seller_key, signed_commit(buyer_key))
+    # The committed vector is the oracle: the generator signed it at the same components.
+    golden = w.POSITIVE_003.headers["Signature-Input"]
+    assert headers["Signature-Input"].startswith(golden.split(";created")[0] + ";")
+    assert "nonce=" not in headers["Signature-Input"]
+    result = verify(
+        response_verifier,
+        HTTPResponse(200, headers, COMMIT_RESULT_BODY, request),
+        expected_origin=SELLER_ORIGIN,
+    )
+    assert result.origin == SELLER_ORIGIN and result.bound and result.body_covered
+
+
+def test_response_to_an_unsigned_request_has_no_binding(
+    response_verifier: ResponseVerifier, seller_key: Ed25519Key
+) -> None:
+    request = HTTPRequest("GET", f"{SELLER}/proposals/prop_7", {})
+    headers = w.response_added(
+        ResponseSigner.of(seller_key, SELLER), 200, JSON, COMMIT_RESULT_BODY, request, now=T0
+    )
+    assert '"signature";req' not in headers["Signature-Input"]
+    result = verify(
+        response_verifier, HTTPResponse(200, {**JSON, **headers}, COMMIT_RESULT_BODY, request)
+    )
+    assert result.bound is False
+
+
+def test_response_binds_to_the_request_label(
+    response_verifier: ResponseVerifier, seller_key: Ed25519Key, buyer_key: Ed25519Key
+) -> None:
+    request = w.craft(buyer_key, label="wba")
+    req, headers = signed_result(seller_key, request)
+    assert '"signature";req;key="wba"' in headers["Signature-Input"]
+    assert verify(response_verifier, HTTPResponse(200, headers, COMMIT_RESULT_BODY, req)).bound
+
+
+def test_response_without_a_body(
+    response_verifier: ResponseVerifier, seller_key: Ed25519Key, buyer_key: Ed25519Key
+) -> None:
+    request = signed_commit(buyer_key)
+    req = request
+    headers = w.response_added(ResponseSigner.of(seller_key, SELLER), 204, {}, b"", req, now=T0)
+    assert "Content-Digest" not in headers
+    assert verify(response_verifier, HTTPResponse(204, headers, b"", req)).body_covered is False
+
+
+def test_unbound_response_to_a_signed_request(
+    response_verifier: ResponseVerifier, buyer_key: Ed25519Key, seller_key: Ed25519Key
+) -> None:
+    request = signed_commit(buyer_key)
+    signed = request
+    unsigned = HTTPRequest(signed.method, signed.url, JSON, signed.body)
+    headers = w.response_added(
+        ResponseSigner.of(seller_key, SELLER), 200, JSON, COMMIT_RESULT_BODY, unsigned, now=T0
+    )
+    expect_refusal(
+        lambda: verify(
+            response_verifier, HTTPResponse(200, {**JSON, **headers}, COMMIT_RESULT_BODY, signed)
+        ),
+        Refusal.RESPONSE_NOT_BOUND,
+    )
+
+
+def test_response_presented_with_another_request(
+    response_verifier: ResponseVerifier, buyer_key: Ed25519Key, seller_key: Ed25519Key
+) -> None:
+    first, headers = signed_result(seller_key, signed_commit(buyer_key))
+    other = signed_commit(buyer_key)
+    other_req = other
+    expect_refusal(
+        lambda: verify(
+            response_verifier, HTTPResponse(200, headers, COMMIT_RESULT_BODY, other_req)
+        ),
+        Refusal.SIGNATURE_INVALID,
+    )
+
+
+@pytest.mark.parametrize(
+    ("status", "body", "refusal"),
+    [
+        (201, COMMIT_RESULT_BODY, Refusal.SIGNATURE_INVALID),
+        (200, COMMIT_RESULT_BODY + b" ", Refusal.CONTENT_DIGEST),
+    ],
+)
+def test_tampered_response(
+    response_verifier: ResponseVerifier,
+    seller_key: Ed25519Key,
+    status: int,
+    body: bytes,
+    refusal: Refusal,
+) -> None:
+    request, headers = signed_result(seller_key, signed_commit(w.buyer_key()))
+    expect_refusal(
+        lambda: verify(response_verifier, HTTPResponse(status, headers, body, request)), refusal
+    )
+
+
+def test_expected_origin(
+    response_verifier: ResponseVerifier, buyer_key: Ed25519Key, seller_key: Ed25519Key
+) -> None:
+    request, headers = signed_result(seller_key, signed_commit(buyer_key))
+    expect_refusal(
+        lambda: verify(
+            response_verifier,
+            HTTPResponse(200, headers, COMMIT_RESULT_BODY, request),
+            expected_origin=w.OTHER_ORIGIN,
+        ),
+        Refusal.ORIGIN_MISMATCH,
+    )
+
+
+def test_key_must_be_in_the_responders_directory(
+    response_verifier: ResponseVerifier, buyer_key: Ed25519Key
+) -> None:
+    request, headers = signed_result(buyer_key, signed_commit(buyer_key))
+    expect_refusal(
+        lambda: verify(response_verifier, HTTPResponse(200, headers, COMMIT_RESULT_BODY, request)),
+        Refusal.KEY_NOT_FOUND,
+    )
+
+
+_REFUSED_SCENARIOS = [
+    s for s in scenarios_document().response_scenarios if isinstance(s.expected, Refuses)
+]
+
+
+@pytest.mark.parametrize("scenario", _REFUSED_SCENARIOS, ids=lambda s: s.id)
+def test_each_refused_response_scenario_is_refused_for_its_rule(
+    response_verifier: ResponseVerifier,
+    buyer_key: Ed25519Key,
+    seller_key: Ed25519Key,
+    scenario: ResponseScenario,
+) -> None:
+    expected = scenario.expected
+    assert isinstance(expected, Refuses)
+    keys: dict[str, Ed25519Key] = {k.thumbprint: k for k in (buyer_key, seller_key)}
+    request, signed = sign_response_scenario(scenarios_document(), scenario, keys, T0)
+    response = signed.message(request.message())
+    expect_refusal(lambda: w.run(response_verifier.verify(response)), expected.rule)
+
+
+def test_response_verify_sync(
+    response_verifier: ResponseVerifier, buyer_key: Ed25519Key, seller_key: Ed25519Key
+) -> None:
+    request, headers = signed_result(seller_key, signed_commit(buyer_key))
+    with SyncRuntime() as runtime:
+        sync = SyncResponseVerifier(response_verifier, runtime=runtime)
+        verified = sync.verify(HTTPResponse(200, headers, COMMIT_RESULT_BODY, request))
+    assert verified.origin == SELLER_ORIGIN
+
+
+def test_a_request_with_two_web_bot_auth_signatures_gets_an_unbound_response(
+    response_verifier: ResponseVerifier, buyer_key: Ed25519Key, seller_key: Ed25519Key
+) -> None:
+    # A request whose web-bot-auth signature is ambiguous has no signature to bind to.
+    agents = f'sig1="{w.BUYER_ORIGIN.directory_url}", sig2="{w.OTHER_ORIGIN.directory_url}"'
+    first = w.sign_request(now=T0, departure=MessageDeparture(signature_agent=agents))
+    second = w.sign_request(
+        first,
+        RequestSigner(SignerConfig(w.other_key(), Origin.parse(w.OTHER), label="sig2")),
+        departure=MessageDeparture(signature_agent=OMIT, keep_signatures=True),
+    )
+    response = ResponseSigner.of(seller_key, SELLER).sign(
+        HTTPResponse(200, JSON, COMMIT_RESULT_BODY, second), now=T0
+    )
+    result = verify(response_verifier, response, expected_origin=SELLER_ORIGIN)
+    assert result.bound is False
+    assert all(c.name != "signature" for c in result.components)
diff --git a/tests/web_bot_auth/test_wba_roles.py b/tests/web_bot_auth/test_wba_roles.py
new file mode 100644
index 0000000..36de4f3
--- /dev/null
+++ b/tests/web_bot_auth/test_wba_roles.py
@@ -0,0 +1,359 @@
+"""The role core: keyword-only, immutable configuration, two owned credentials,
+per-origin replay, the reject list on both roles, and the narrow nonce store."""
+
+from __future__ import annotations
+
+import asyncio
+import dataclasses
+
+import httpx
+import pytest
+
+from iab_agentic_primitives.web_bot_auth import (
+    CONFORMANCE_KEYS,
+    DirectoryResolver,
+    Ed25519Key,
+    FetchLimits,
+    HTTPRequest,
+    HTTPResponse,
+    KeyPolicy,
+    MemoryNonceStore,
+    Origin,
+    RequestSigner,
+    RequestVerifier,
+    ResolvedKey,
+    ResponseSigner,
+    ResponseVerifier,
+    Seconds,
+    ServerIdentity,
+    StaticKeyResolver,
+    UnixSeconds,
+    VerifiedRequest,
+    VerifiedResponse,
+)
+from iab_agentic_primitives.web_bot_auth.asgi import (
+    Receive,
+    RequireSignatureMiddleware,
+    ResponseSigningMiddleware,
+    Scope,
+    Send,
+    verified_request,
+)
+from iab_agentic_primitives.web_bot_auth.conformance import published_keys
+from iab_agentic_primitives.web_bot_auth.errors import Refusal
+from iab_agentic_primitives.web_bot_auth.httpx import WebBotAuth, verified_response
+from iab_agentic_primitives.web_bot_auth.signer import SignerConfig
+from iab_agentic_primitives.web_bot_auth.sync import SyncRequestVerifier, SyncRuntime
+from iab_agentic_primitives.web_bot_auth.values import KeyId
+
+from .support import (
+    BUYER,
+    BUYER_ORIGIN,
+    COMMIT_RESULT_BODY,
+    COMMIT_URL,
+    JSON,
+    OTHER,
+    SELLER,
+    SELLER_IDENTITY,
+    T0,
+    buyer_key,
+    expect_refusal,
+    other_key,
+    seller_edge,
+    seller_key,
+    sign_request,
+)
+
+
+class RecordingStore(MemoryNonceStore):
+    """A memory store that keeps every pair it was asked to record."""
+
+    def __init__(self) -> None:
+        super().__init__(clock=lambda: T0)
+        self.asked: list[tuple[Origin, str]] = []
+
+    async def check_and_record(self, origin: Origin, nonce: str, ttl: Seconds) -> bool:
+        self.asked.append((origin, nonce))
+        return await super().check_and_record(origin, nonce, ttl)
+
+
+def _verifier(nonces: MemoryNonceStore, **keys: list[Ed25519Key]) -> RequestVerifier:
+    return RequestVerifier(
+        StaticKeyResolver({BUYER: keys.get("buyer", []), OTHER: keys.get("other", [])}),
+        identity=SELLER_IDENTITY,
+        nonces=nonces,
+        clock=lambda: T0,
+        keys=CONFORMANCE_KEYS,
+    )
+
+
+def _signed(key: Ed25519Key, origin: str, nonce: str) -> HTTPRequest:
+    return RequestSigner.of(key, origin).sign(HTTPRequest("GET", COMMIT_URL), now=T0, nonce=nonce)
+
+
+NONCE = "A" * 86
+
+
+# ── per-origin replay ─────────────────────────────────────────────────────
+
+
+def test_a_nonce_is_recorded_per_origin() -> None:
+    store = RecordingStore()
+    verifier = _verifier(store, buyer=[buyer_key(), other_key()], other=[buyer_key()])
+    asyncio.run(verifier.verify(_signed(buyer_key(), BUYER, NONCE)))
+    assert store.asked == [(BUYER_ORIGIN, NONCE)]
+    # The same nonce from another origin, with the same key, is a new pair.
+    asyncio.run(verifier.verify(_signed(buyer_key(), OTHER, NONCE)))
+    # The same nonce from the same origin, with another of its keys, is a replay.
+    replayed = _signed(other_key(), BUYER, NONCE)
+    expect_refusal(lambda: verifier.verify(replayed), Refusal.NONCE_REPLAYED)
+
+
+# ── the reject list on both roles ─────────────────────────────────────────
+
+
+def test_a_response_signed_by_a_rejected_key_is_refused() -> None:
+    request = RequestSigner.of(buyer_key(), BUYER).sign(
+        HTTPRequest("POST", COMMIT_URL, JSON, b"{}")
+    )
+    response = ResponseSigner.of(seller_key(), SELLER).sign(
+        HTTPResponse(200, JSON, COMMIT_RESULT_BODY, request), now=T0
+    )
+    verifier = ResponseVerifier(
+        StaticKeyResolver({SELLER: [seller_key()]}),
+        clock=lambda: T0,
+        keys=KeyPolicy(reject_keyids={seller_key().thumbprint}, accept_test_keys=True),
+    )
+    expect_refusal(lambda: verifier.verify(response), Refusal.REJECTED_KEY)
+
+
+def test_a_request_signed_by_a_rejected_key_is_refused() -> None:
+    verifier = RequestVerifier(
+        StaticKeyResolver({BUYER: [buyer_key()]}),
+        identity=SELLER_IDENTITY,
+        nonces=MemoryNonceStore(clock=lambda: T0),
+        clock=lambda: T0,
+        keys=KeyPolicy(reject_keyids={buyer_key().thumbprint}, accept_test_keys=True),
+    )
+    rejected = _signed(buyer_key(), BUYER, NONCE)
+    expect_refusal(lambda: verifier.verify(rejected), Refusal.REJECTED_KEY)
+
+
+@pytest.mark.parametrize("kid", sorted(published_keys()))
+def test_a_verifier_refuses_every_published_test_key_whatever_else_it_lists(kid: str) -> None:
+    key, own = published_keys()[kid], Ed25519Key.generate()
+
+    def verifier(keys: KeyPolicy) -> RequestVerifier:
+        return RequestVerifier(
+            StaticKeyResolver({BUYER: [key, own]}),
+            identity=SELLER_IDENTITY,
+            nonces=MemoryNonceStore(clock=lambda: T0),
+            clock=lambda: T0,
+            keys=keys,
+        )
+
+    def signed(by: Ed25519Key) -> HTTPRequest:
+        return RequestSigner.of(by, BUYER).sign(HTTPRequest("GET", COMMIT_URL), now=T0)
+
+    listing_own = verifier(KeyPolicy(reject_keyids={own.thumbprint}))
+    expect_refusal(lambda: listing_own.verify(signed(key)), Refusal.REJECTED_KEY)
+    expect_refusal(lambda: listing_own.verify(signed(own)), Refusal.REJECTED_KEY)
+    default = RequestVerifier(
+        StaticKeyResolver({BUYER: [key]}),
+        identity=SELLER_IDENTITY,
+        nonces=MemoryNonceStore(clock=lambda: T0),
+        clock=lambda: T0,
+    )
+    expect_refusal(lambda: default.verify(signed(key)), Refusal.REJECTED_KEY)
+    conformance = verifier(CONFORMANCE_KEYS)
+    assert asyncio.run(conformance.verify(signed(key))).keyid == kid
+    request = signed(buyer_key())
+    response = ResponseSigner.of(key, SELLER).sign(
+        HTTPResponse(200, JSON, COMMIT_RESULT_BODY, request), now=T0
+    )
+    responses = ResponseVerifier(
+        StaticKeyResolver({SELLER: [key]}),
+        clock=lambda: T0,
+        keys=KeyPolicy(reject_keyids={own.thumbprint}),
+    )
+    expect_refusal(lambda: responses.verify(response), Refusal.REJECTED_KEY)
+
+
+def test_a_default_seller_refuses_a_buyer_signing_with_a_test_key() -> None:
+    verifier = RequestVerifier(
+        StaticKeyResolver({BUYER: [buyer_key()]}),
+        identity=SELLER_IDENTITY,
+        nonces=MemoryNonceStore(),
+    )
+    edge = seller_edge(verifier)
+    app = ResponseSigningMiddleware(RequireSignatureMiddleware(_ok, edge), edge)
+    auth = WebBotAuth(RequestSigner.of(buyer_key(), BUYER))
+
+    async def post() -> httpx.Response:
+        async with auth.async_client(transport=httpx.ASGITransport(app=app)) as c:
+            return await c.post(COMMIT_URL, json={})
+
+    response = asyncio.run(post())
+    assert response.status_code == 403 and response.json()["error"] == "rejected-key"
+
+
+# ── the authority check ───────────────────────────────────────────────────
+
+
+@pytest.mark.parametrize("url", ["/proposals/prop_7/commit", "seller.example.com/x", ""])
+def test_a_request_url_that_is_not_absolute_is_refused(url: str) -> None:
+    signed = _signed(buyer_key(), BUYER, NONCE)
+    request = HTTPRequest("GET", url, signed.headers)
+    verifier = _verifier(MemoryNonceStore(clock=lambda: T0), buyer=[buyer_key()])
+    expect_refusal(lambda: verifier.verify(request), Refusal.AUTHORITY)
+
+
+# ── keyword-only, immutable configuration ─────────────────────────────────
+
+
+def test_verifier_arguments_after_the_resolver_are_keyword_only() -> None:
+    resolver = StaticKeyResolver({})
+    with pytest.raises(TypeError):
+        RequestVerifier(resolver, lambda: T0, keys=CONFORMANCE_KEYS)  # type: ignore[arg-type, call-arg]
+    with pytest.raises(TypeError):
+        RequestVerifier(resolver, nonces=MemoryNonceStore(), keys=CONFORMANCE_KEYS)  # type: ignore[call-arg]
+    with pytest.raises(TypeError):
+        ResponseVerifier(resolver, MemoryNonceStore(), keys=CONFORMANCE_KEYS)  # type: ignore[arg-type, call-arg]
+
+
+#: Setting a name that isn't a field of a slotted frozen dataclass raises
+#: FrozenInstanceError from CPython 3.14 and TypeError before it.
+NOT_A_FIELD = (dataclasses.FrozenInstanceError, TypeError)
+
+
+def test_signers_their_config_and_keys_are_frozen() -> None:
+    signer = RequestSigner.of(buyer_key(), BUYER)
+    with pytest.raises(dataclasses.FrozenInstanceError):
+        ResponseSigner.of(seller_key(), SELLER).config = signer.config  # type: ignore[misc]
+    with pytest.raises(dataclasses.FrozenInstanceError):
+        signer.config.lifetime = 100_000  # type: ignore[misc]
+    assert signer.config.lifetime == 300
+    key = buyer_key()
+    public = key.public_key
+    with pytest.raises(NOT_A_FIELD):
+        key.public_key = other_key().public_key  # type: ignore[misc]
+    assert key.public_key is public
+    assert not hasattr(key, "private_key") and not hasattr(key, "kid")
+
+
+def test_signer_config_checks_its_values_once() -> None:
+    config = SignerConfig(buyer_key(), BUYER_ORIGIN, label="b1", lifetime=60)
+    assert (config.origin, config.label, config.lifetime) == (BUYER_ORIGIN, "b1", 60)
+    with pytest.raises(ValueError):
+        SignerConfig(buyer_key(), BUYER)  # type: ignore[arg-type]
+
+
+# ── two owned credentials and their accessors ─────────────────────────────
+
+
+def _needs_request(verified: VerifiedRequest) -> str:
+    return verified.nonce
+
+
+def test_the_two_credentials_are_distinct_types() -> None:
+    verified = asyncio.run(
+        _verifier(MemoryNonceStore(clock=lambda: T0), buyer=[buyer_key()]).verify(
+            _signed(buyer_key(), BUYER, NONCE)
+        )
+    )
+    assert _needs_request(verified) == NONCE
+    request = RequestSigner.of(buyer_key(), BUYER).sign(HTTPRequest("GET", COMMIT_URL))
+    response = asyncio.run(
+        ResponseVerifier(
+            StaticKeyResolver({SELLER: [seller_key()]}), clock=lambda: T0, keys=CONFORMANCE_KEYS
+        ).verify(
+            ResponseSigner.of(seller_key(), SELLER).sign(
+                HTTPResponse(200, {}, b"", request), now=T0
+            )
+        )
+    )
+    assert isinstance(response, VerifiedResponse) and not isinstance(response, VerifiedRequest)
+    with pytest.raises(AttributeError):
+        _needs_request(response)  # type: ignore[arg-type]
+
+
+def test_the_accessors_read_only_their_own_credential() -> None:
+    verified = asyncio.run(
+        _verifier(MemoryNonceStore(clock=lambda: T0), buyer=[buyer_key()]).verify(
+            _signed(buyer_key(), BUYER, NONCE)
+        )
+    )
+    assert verified.origin == BUYER_ORIGIN
+    assert verified_request({}) is None
+    assert verified_response(httpx.Response(200)) is None
+
+
+def test_a_static_resolver_returns_a_resolved_key_without_a_directory() -> None:
+    resolved = asyncio.run(
+        StaticKeyResolver({BUYER: [buyer_key()]}).resolve(
+            BUYER_ORIGIN, KeyId(buyer_key().thumbprint), now=T0
+        )
+    )
+    assert isinstance(resolved, ResolvedKey) and resolved.directory is None
+    assert resolved.public_key == buyer_key().public_key
+
+
+# ── the role ports, and holders fixed when they are made ─────────────────
+
+
+class AllowlistedVerifier:
+    """An application's own confirmer: the profile's verifier, then its own origin list."""
+
+    def __init__(self, verifier: RequestVerifier, allowed: frozenset[Origin]) -> None:
+        self._verifier = verifier
+        self._allowed = allowed
+
+    @property
+    def identity(self) -> ServerIdentity:
+        return self._verifier.identity
+
+    async def verify(
+        self, request: HTTPRequest, *, now: UnixSeconds | None = None
+    ) -> VerifiedRequest:
+        verified = await self._verifier.verify(request, now=now)
+        if verified.origin not in self._allowed:
+            raise PermissionError(f"{verified.origin} is not on the list")
+        return verified
+
+
+def test_an_application_confirmer_serves_every_edge() -> None:
+    confirmer = AllowlistedVerifier(
+        _verifier(MemoryNonceStore(clock=lambda: T0), buyer=[buyer_key()]),
+        frozenset({BUYER_ORIGIN}),
+    )
+    middleware = RequireSignatureMiddleware(_ok, seller_edge(confirmer))
+    assert middleware.confirmer is confirmer
+    with SyncRuntime() as runtime:
+        sync = SyncRequestVerifier(confirmer, runtime=runtime)
+        assert sync.verify(sign_request(now=T0)).origin == BUYER_ORIGIN
+
+
+async def _ok(scope: Scope, receive: Receive, send: Send) -> None:
+    await send({"type": "http.response.start", "status": 200, "headers": []})
+    await send({"type": "http.response.body", "body": b""})
+
+
+def test_the_roles_resolver_and_edges_are_fixed_when_made() -> None:
+    verifier = _verifier(MemoryNonceStore(clock=lambda: T0), buyer=[buyer_key()])
+    other = ServerIdentity.from_config("https://evil.example.com")
+    with pytest.raises(dataclasses.FrozenInstanceError):
+        verifier.identity = other  # type: ignore[misc]
+    with pytest.raises(dataclasses.FrozenInstanceError):
+        verifier.nonces = MemoryNonceStore()  # type: ignore[misc]
+    resolver = DirectoryResolver()
+    with pytest.raises(AttributeError):
+        resolver.limits = FetchLimits(max_keys=1)  # type: ignore[misc]
+    edge = seller_edge(verifier)
+    middleware = RequireSignatureMiddleware(_ok, edge)
+    with pytest.raises(dataclasses.FrozenInstanceError):
+        middleware.confirmer = verifier  # type: ignore[misc]
+    with pytest.raises(dataclasses.FrozenInstanceError):
+        edge.identity = other  # type: ignore[misc]
+    auth = WebBotAuth(RequestSigner.of(buyer_key(), BUYER))
+    with pytest.raises(AttributeError):
+        auth.signer = None  # type: ignore[misc]
diff --git a/tests/web_bot_auth/test_wba_rules.py b/tests/web_bot_auth/test_wba_rules.py
new file mode 100644
index 0000000..bc8fd94
--- /dev/null
+++ b/tests/web_bot_auth/test_wba_rules.py
@@ -0,0 +1,234 @@
+"""The profile rules: every signer configuration round-trips, every bad one is
+refused at construction, and the verifiers require exactly the rules' components.
+
+The windows are graded where they apply: the message window by the request and
+response verifiers, the directory window by the directory tests.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import base64
+
+import pytest
+
+from iab_agentic_primitives.web_bot_auth import (
+    ConfigurationError,
+    HTTPRequest,
+    HTTPResponse,
+    Origin,
+    RequestSigner,
+    RequestVerifier,
+    ResponseSigner,
+    ResponseVerifier,
+    StaticKeyResolver,
+    VerifiedRequest,
+    VerifiedResponse,
+    WebBotAuthError,
+)
+from iab_agentic_primitives.web_bot_auth.conformance.signing import (
+    MessageDeparture,
+    RawSigner,
+    components_of,
+)
+from iab_agentic_primitives.web_bot_auth.errors import Refusal
+from iab_agentic_primitives.web_bot_auth.rules import (
+    MAX_LIFETIME,
+    REQUEST,
+    RESPONSE,
+)
+from iab_agentic_primitives.web_bot_auth.signer import SignerConfig
+
+from .support import (
+    BUYER,
+    COMMIT_BODY,
+    COMMIT_RESULT_BODY,
+    COMMIT_URL,
+    JSON,
+    SELLER,
+    T0,
+    UnixSeconds,
+    at,
+    buyer_key,
+    request_verifier,
+    response_verifier,
+    seller_key,
+    spec,
+)
+
+LABELS = ["sig1", "a", "x-1.*"]
+LIFETIMES = [1, 150, MAX_LIFETIME]
+NONCE_BYTES = bytes(range(64))
+NONCES = {
+    "base64url": base64.urlsafe_b64encode(NONCE_BYTES).rstrip(b"=").decode(),
+    "base64": base64.b64encode(NONCE_BYTES).decode(),
+}
+
+
+def _request_verifier(now: UnixSeconds) -> RequestVerifier:
+    return request_verifier(resolver=StaticKeyResolver({BUYER: [buyer_key()]}), now=now)
+
+
+def _response_verifier(now: UnixSeconds) -> ResponseVerifier:
+    return response_verifier(resolver=StaticKeyResolver({SELLER: [seller_key()]}), now=now)
+
+
+def _request(has_body: bool) -> HTTPRequest:
+    if has_body:
+        return HTTPRequest("POST", COMMIT_URL, JSON, COMMIT_BODY)
+    return HTTPRequest("GET", COMMIT_URL)
+
+
+# ── round trips over the signer's options ────────────────────────────────
+
+
+@pytest.mark.parametrize("encoding", sorted(NONCES))
+@pytest.mark.parametrize("has_body", [True, False], ids=["body", "no-body"])
+@pytest.mark.parametrize("lifetime", LIFETIMES)
+@pytest.mark.parametrize("label", LABELS)
+def test_every_request_configuration_signs_and_verifies(
+    label: str, lifetime: int, has_body: bool, encoding: str
+) -> None:
+    signer = RequestSigner(
+        SignerConfig(buyer_key(), Origin.parse(BUYER), label=label, lifetime=lifetime)
+    )
+    signed = signer.sign(_request(has_body), now=T0, nonce=NONCES[encoding])
+    verified = asyncio.run(_request_verifier(at(lifetime)).verify(signed))
+    assert (verified.label, verified.expires, verified.nonce) == (
+        label,
+        at(lifetime),
+        NONCES[encoding],
+    )
+    assert verified.components == REQUEST.components(label, has_body=has_body)
+    assert verified.body_covered is has_body
+
+
+@pytest.mark.parametrize("bound", [True, False], ids=["bound", "unbound"])
+@pytest.mark.parametrize("has_body", [True, False], ids=["body", "no-body"])
+@pytest.mark.parametrize("lifetime", LIFETIMES)
+@pytest.mark.parametrize("label", LABELS)
+def test_every_response_configuration_signs_and_verifies(
+    label: str, lifetime: int, has_body: bool, bound: bool
+) -> None:
+    request = _request(True)
+    if bound:
+        request = RequestSigner.of(buyer_key(), BUYER).sign(request, now=T0)
+    body = COMMIT_RESULT_BODY if has_body else b""
+    response = HTTPResponse(200, JSON if has_body else {}, body, request)
+    signer = ResponseSigner(
+        SignerConfig(seller_key(), Origin.parse(SELLER), label=label, lifetime=lifetime)
+    )
+    signed = signer.sign(response, now=T0)
+    verified = asyncio.run(_response_verifier(at(lifetime)).verify(signed))
+    request_label = "sig1" if bound else None
+    expected = RESPONSE.components(label, has_body=has_body, request_label=request_label)
+    assert verified.components == expected
+    assert (verified.label, verified.bound) == (label, bound)
+
+
+# ── configurations the signers refuse ─────────────────────────────────────
+
+
+@pytest.mark.parametrize("signer", [RequestSigner, ResponseSigner])
+@pytest.mark.parametrize(
+    "options",
+    [
+        {"lifetime": 0},
+        {"lifetime": MAX_LIFETIME + 1},
+        {"lifetime": -1},
+        {"lifetime": True},
+        {"lifetime": "300"},
+        {"label": "Sig1"},
+        {"label": "1sig"},
+        {"label": ""},
+        {"label": "sig 1"},
+        {"label": 1},
+    ],
+    ids=[
+        "lifetime-0",
+        "lifetime-301",
+        "lifetime-negative",
+        "lifetime-bool",
+        "lifetime-str",
+        "label-uppercase",
+        "label-digit-first",
+        "label-empty",
+        "label-space",
+        "label-int",
+    ],
+)
+def test_a_signer_refuses_an_out_of_range_configuration(
+    signer: type[RequestSigner] | type[ResponseSigner], options: dict[str, object]
+) -> None:
+    with pytest.raises(ConfigurationError):
+        signer(SignerConfig(buyer_key(), Origin.parse(BUYER), **options))  # type: ignore[arg-type]
+
+
+# ── the verifiers require exactly the rules' components ──────────────────
+
+
+def _crafted_request(label: str, has_body: bool, components: list[str]) -> HTTPRequest:
+    covered = MessageDeparture(components=components_of(components, label))
+    config = SignerConfig(buyer_key(), Origin.parse(BUYER), label=label)
+    return RawSigner(config, covered).request(_request(has_body), T0)
+
+
+def _request_outcome(request: HTTPRequest) -> VerifiedRequest | Refusal:
+    try:
+        return asyncio.run(_request_verifier(T0).verify(request))
+    except WebBotAuthError as e:
+        return e.refusal
+
+
+@pytest.mark.parametrize("has_body", [True, False], ids=["body", "no-body"])
+@pytest.mark.parametrize("label", ["sig1", "agent7"])
+def test_the_request_verifier_requires_exactly_the_rules_components(
+    label: str, has_body: bool
+) -> None:
+    components = [spec(c) for c in REQUEST.components(label, has_body=has_body)]
+    assert isinstance(
+        _request_outcome(_crafted_request(label, has_body, components)), VerifiedRequest
+    )
+    for dropped in components:
+        kept = [c for c in components if c != dropped]
+        outcome = _request_outcome(_crafted_request(label, has_body, kept))
+        assert outcome in (Refusal.COMPONENTS, Refusal.SIGNATURE_AGENT_NOT_COVERED), dropped
+
+
+def _crafted_response(
+    label: str, has_body: bool, bound: bool, components: list[str]
+) -> HTTPResponse:
+    request = _request(True)
+    if bound:
+        request = RequestSigner.of(buyer_key(), BUYER).sign(request, now=T0)
+    body = COMMIT_RESULT_BODY if has_body else b""
+    covered = MessageDeparture(components=components_of(components, label))
+    config = SignerConfig(seller_key(), Origin.parse(SELLER), label=label)
+    return RawSigner(config, covered).response(
+        HTTPResponse(200, JSON if has_body else {}, body, request), T0
+    )
+
+
+def _response_outcome(response: HTTPResponse) -> VerifiedResponse | Refusal:
+    try:
+        return asyncio.run(_response_verifier(T0).verify(response))
+    except WebBotAuthError as e:
+        return e.refusal
+
+
+@pytest.mark.parametrize("bound", [True, False], ids=["bound", "unbound"])
+@pytest.mark.parametrize("has_body", [True, False], ids=["body", "no-body"])
+@pytest.mark.parametrize("label", ["sig1", "agent7"])
+def test_the_response_verifier_requires_exactly_the_rules_components(
+    label: str, has_body: bool, bound: bool
+) -> None:
+    request_label = "sig1" if bound else None
+    rules = RESPONSE.components(label, has_body=has_body, request_label=request_label)
+    components = [spec(c) for c in rules]
+    signed = _crafted_response(label, has_body, bound, components)
+    assert isinstance(_response_outcome(signed), VerifiedResponse)
+    refusals = (Refusal.COMPONENTS, Refusal.SIGNATURE_AGENT_NOT_COVERED, Refusal.RESPONSE_NOT_BOUND)
+    for dropped in components:
+        kept = [c for c in components if c != dropped]
+        outcome = _response_outcome(_crafted_response(label, has_body, bound, kept))
+        assert outcome in refusals, dropped
diff --git a/tests/web_bot_auth/test_wba_sync.py b/tests/web_bot_auth/test_wba_sync.py
new file mode 100644
index 0000000..511bd98
--- /dev/null
+++ b/tests/web_bot_auth/test_wba_sync.py
@@ -0,0 +1,428 @@
+"""The sync runtime and façades against real directory servers over one pooled client.
+
+A uvicorn server on localhost serves each signed key directory. The injected
+``AsyncClient`` keeps its connections alive, so a call run on any loop but the
+resolver's one would strand the pool on a closed loop and fail.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import contextlib
+import json
+import os
+import socket
+import threading
+import time
+import warnings
+from collections.abc import Callable, Iterator
+
+import httpx
+import pytest
+import uvicorn
+
+from iab_agentic_primitives.web_bot_auth import (
+    CONFORMANCE_KEYS,
+    CachePolicy,
+    ConfigurationError,
+    DirectoryPublisher,
+    DirectoryResolver,
+    HTTPRequest,
+    HTTPResponse,
+    MemoryNonceStore,
+    Origin,
+    RequestSigner,
+    RequestVerifier,
+    ResponseSigner,
+    ResponseVerifier,
+    ServerIdentity,
+    StaticKeyResolver,
+    VerifiedResponse,
+    system_clock,
+)
+from iab_agentic_primitives.web_bot_auth.asgi import (
+    ASGIApp,
+    DirectoryMiddleware,
+    Receive,
+    Scope,
+    Send,
+)
+from iab_agentic_primitives.web_bot_auth.fetcher import HttpxDirectoryFetcher
+from iab_agentic_primitives.web_bot_auth.httpx import WebBotAuth, verified_response
+from iab_agentic_primitives.web_bot_auth.sync import (
+    SyncRequestVerifier,
+    SyncResponseVerifier,
+    SyncRuntime,
+)
+
+from .support import (
+    BUYER,
+    BUYER_ORIGIN,
+    COMMIT_URL,
+    JSON,
+    SELLER,
+    SELLER_IDENTITY,
+    SELLER_ORIGIN,
+    buyer_key,
+    seller_key,
+)
+
+
+async def _not_found(scope: Scope, receive: Receive, send: Send) -> None:
+    await send({"type": "http.response.start", "status": 404, "headers": []})
+    await send({"type": "http.response.body", "body": b""})
+
+
+def _free_port() -> int:
+    with socket.socket() as s:
+        s.bind(("127.0.0.1", 0))
+        port: int = s.getsockname()[1]
+        return port
+
+
+#: Directory fetches served, by host.
+FETCHES: dict[str, int] = {}
+
+
+def _counting(host: str, app: ASGIApp) -> ASGIApp:
+    async def counted(scope: Scope, receive: Receive, send: Send) -> None:
+        if scope["type"] == "http":
+            FETCHES[host] = FETCHES.get(host, 0) + 1
+        await app(scope, receive, send)
+
+    return counted
+
+
+@pytest.fixture(scope="module")
+def ports() -> Iterator[dict[str, int]]:
+    """One uvicorn directory server per identity, by host."""
+    servers: list[tuple[uvicorn.Server, threading.Thread]] = []
+    ports: dict[str, int] = {}
+    for origin, key in ((BUYER, buyer_key()), (SELLER, seller_key())):
+        identity = ServerIdentity.from_config(origin)
+        app = _counting(
+            identity.origin.host,
+            DirectoryMiddleware(_not_found, DirectoryPublisher(identity.origin, [key])),
+        )
+        port = _free_port()
+        config = uvicorn.Config(app, host="127.0.0.1", port=port, log_level="error")
+        server = uvicorn.Server(config)
+        thread = threading.Thread(target=server.run, daemon=True)
+        thread.start()
+        servers.append((server, thread))
+        ports[identity.origin.host] = port
+    deadline = time.monotonic() + 10
+    while not all(server.started for server, _ in servers):
+        assert time.monotonic() < deadline, "the directory servers didn't start"
+        time.sleep(0.01)
+    yield ports
+    for server, thread in servers:
+        server.should_exit = True
+        thread.join(timeout=5)
+
+
+class _Local(httpx.AsyncHTTPTransport):
+    """A real pooled transport that sends each identity's directory fetch to its server."""
+
+    def __init__(self, ports: dict[str, int]) -> None:
+        super().__init__()
+        self.ports = ports
+
+    async def handle_async_request(self, request: httpx.Request) -> httpx.Response:
+        # The client's own request keeps the identity's URL; only the connection goes local.
+        port = self.ports[request.url.host]
+        url = request.url.copy_with(scheme="http", host="127.0.0.1", port=port)
+        local = httpx.Request(request.method, url, headers=request.headers, stream=request.stream)
+        return await super().handle_async_request(local)
+
+
+def _resolver(ports: dict[str, int]) -> DirectoryResolver:
+    # max_cache_age=0: every verify fetches again, over the same pool.
+    client = httpx.AsyncClient(transport=_Local(ports))
+    return DirectoryResolver(HttpxDirectoryFetcher(client), cache=CachePolicy(max_cache_age=0))
+
+
+async def _failing(resolver: DirectoryResolver, origin: str) -> bool:
+    """True when the resolver's store holds a failed fetch of ``origin``."""
+    until = await resolver.store.failure_until(Origin.parse(origin))
+    return until is not None and system_clock() < until
+
+
+def _signed() -> HTTPRequest:
+    return RequestSigner.of(buyer_key(), BUYER).sign(HTTPRequest("GET", COMMIT_URL))
+
+
+def test_a_hundred_sync_verifies_share_one_pooled_client(ports: dict[str, int]) -> None:
+    resolver = _resolver(ports)
+    verifier = RequestVerifier(
+        resolver, identity=SELLER_IDENTITY, nonces=MemoryNonceStore(), keys=CONFORMANCE_KEYS
+    )
+    before = FETCHES.get("buyer.example.com", 0)
+    with SyncRuntime(resolver) as runtime:
+        sync = SyncRequestVerifier(verifier, runtime=runtime)
+        origins = {str(sync.verify(_signed()).origin) for _ in range(100)}
+        # Every call refetched, and none failed: a stranded pool fails a fetch, and the
+        # cached directory would hide it from the verdict.
+        assert not runtime.run(_failing(resolver, BUYER))
+    assert origins == {BUYER}
+    assert FETCHES["buyer.example.com"] - before == 100
+
+
+def test_two_facades_over_one_resolver_share_its_runtime(ports: dict[str, int]) -> None:
+    resolver = _resolver(ports)
+    requests = RequestVerifier(
+        resolver, identity=SELLER_IDENTITY, nonces=MemoryNonceStore(), keys=CONFORMANCE_KEYS
+    )
+    with SyncRuntime(resolver) as runtime:
+        first = SyncRequestVerifier(requests, runtime=runtime)
+        second = SyncRequestVerifier(requests, runtime=runtime)
+        assert first.verify(_signed()).origin == second.verify(_signed()).origin
+
+
+def test_a_sync_verify_inside_a_running_loop_raises(ports: dict[str, int]) -> None:
+    resolver = _resolver(ports)
+    verifier = RequestVerifier(
+        resolver, identity=SELLER_IDENTITY, nonces=MemoryNonceStore(), keys=CONFORMANCE_KEYS
+    )
+
+    async def inside(sync: SyncRequestVerifier) -> None:
+        sync.verify(_signed())
+
+    with SyncRuntime(resolver) as runtime, pytest.raises(RuntimeError, match="running"):
+        asyncio.run(inside(SyncRequestVerifier(verifier, runtime=runtime)))
+
+
+def test_close_stops_the_runtime_thread(ports: dict[str, int]) -> None:
+    before = set(threading.enumerate())
+    runtime = SyncRuntime(_resolver(ports))
+    owned = set(threading.enumerate()) - before
+    assert len(owned) == 1
+    runtime.close()
+    assert not owned & set(threading.enumerate())
+    runtime.close()  # a second close does nothing
+    sync = SyncResponseVerifier(
+        ResponseVerifier(_resolver(ports), keys=CONFORMANCE_KEYS), runtime=runtime
+    )
+    unsigned = HTTPResponse(200, {}, b"", HTTPRequest("GET", f"{SELLER}/proposals/prop_7"))
+    with pytest.raises(ConfigurationError, match="closed"):
+        sync.verify(unsigned)
+
+
+def _seller(signer: ResponseSigner) -> httpx.MockTransport:
+    def answer(request: httpx.Request) -> httpx.Response:
+        incoming = HTTPRequest(
+            request.method, str(request.url), request.headers.multi_items(), request.content
+        )
+        body = json.dumps({"ok": True}).encode()
+        signed = signer.sign(HTTPResponse(200, JSON, body, incoming))
+        return httpx.Response(200, headers=signed.headers.items(), content=body)
+
+    return httpx.MockTransport(answer)
+
+
+def test_a_sync_client_verifies_every_response_over_one_pooled_client(
+    ports: dict[str, int],
+) -> None:
+    resolver = _resolver(ports)
+    before = FETCHES.get("seller.example.com", 0)
+    with SyncRuntime(resolver) as runtime:
+        auth = WebBotAuth(
+            RequestSigner.of(buyer_key(), BUYER),
+            ResponseVerifier(resolver, keys=CONFORMANCE_KEYS),
+            runtime=runtime,
+        )
+        seller = _seller(ResponseSigner.of(seller_key(), SELLER))
+        with auth.client(transport=seller) as client:
+            bound = [verified_response(client.post(COMMIT_URL, json={})) for _ in range(20)]
+        assert not runtime.run(_failing(resolver, SELLER))
+    assert all(v is not None and v.bound and str(v.origin) == SELLER for v in bound)
+    assert FETCHES["seller.example.com"] - before == 20
+
+
+def test_one_auth_serves_a_sync_and_an_async_client(ports: dict[str, int]) -> None:
+    resolver = _resolver(ports)
+    seller = _seller(ResponseSigner.of(seller_key(), SELLER))
+    with SyncRuntime(resolver) as runtime:
+        auth = WebBotAuth(
+            RequestSigner.of(buyer_key(), BUYER),
+            ResponseVerifier(resolver, keys=CONFORMANCE_KEYS),
+            runtime=runtime,
+        )
+        with auth.client(transport=seller) as client:
+            first = [verified_response(client.post(COMMIT_URL, json={})) for _ in range(3)]
+
+        async def post() -> list[VerifiedResponse | None]:
+            async with auth.async_client(transport=seller) as client:
+                return [verified_response(await client.post(COMMIT_URL, json={})) for _ in range(3)]
+
+        second = asyncio.run(post())
+        with auth.client(transport=seller) as client:
+            third = [verified_response(client.post(COMMIT_URL, json={})) for _ in range(3)]
+    verified = [*first, *second, *third]
+    assert all(v is not None and v.origin == SELLER_ORIGIN for v in verified)
+
+
+def test_a_sync_client_without_a_runtime_is_refused_as_configuration() -> None:
+    auth = WebBotAuth(
+        RequestSigner.of(buyer_key(), BUYER),
+        ResponseVerifier(StaticKeyResolver({}), keys=CONFORMANCE_KEYS),
+    )
+    seller = _seller(ResponseSigner.of(seller_key(), SELLER))
+    with pytest.raises(ConfigurationError, match="SyncRuntime"):
+        auth.client(transport=seller)
+
+
+def test_closed_sync_clients_leave_no_thread_behind(ports: dict[str, int]) -> None:
+    before = set(threading.enumerate())
+    resolver = _resolver(ports)
+    seller = _seller(ResponseSigner.of(seller_key(), SELLER))
+    with SyncRuntime(resolver) as runtime:
+        for _ in range(20):
+            auth = WebBotAuth(
+                RequestSigner.of(buyer_key(), BUYER),
+                ResponseVerifier(resolver, keys=CONFORMANCE_KEYS),
+                runtime=runtime,
+            )
+            with auth.client(transport=seller) as client:
+                assert verified_response(client.post(COMMIT_URL, json={})) is not None
+        assert len(set(threading.enumerate()) - before) == 1  # the runtime's, and only it
+    assert not set(threading.enumerate()) - before
+
+
+async def _hang(request: httpx.Request) -> httpx.Response:
+    await asyncio.sleep(3600)
+    raise AssertionError("unreachable")
+
+
+def test_closing_the_runtime_mid_verify_frees_the_caller_in_time() -> None:
+    hanging = DirectoryResolver(HttpxDirectoryFetcher(transport=httpx.MockTransport(_hang)))
+    runtime = SyncRuntime(hanging)
+    sync = SyncRequestVerifier(
+        RequestVerifier(
+            hanging, identity=SELLER_IDENTITY, nonces=MemoryNonceStore(), keys=CONFORMANCE_KEYS
+        ),
+        runtime=runtime,
+    )
+    outcome: list[BaseException] = []
+
+    def call() -> None:
+        try:
+            sync.verify(_signed())
+        except BaseException as e:  # the test reads what the caller got
+            outcome.append(e)
+
+    caller = threading.Thread(target=call)
+    caller.start()
+    time.sleep(0.2)  # the fetch is in flight
+    started = time.monotonic()
+    runtime.close()
+    caller.join(timeout=2)
+    assert not caller.is_alive() and time.monotonic() - started < 2
+    assert len(outcome) == 1 and isinstance(outcome[0], ConfigurationError)
+
+
+def test_a_cancelled_verify_leaves_the_next_one_to_succeed(ports: dict[str, int]) -> None:
+    # A verify cancelled while its fetch is in flight leaves no dead fetch behind it.
+    resolver = _resolver(ports)
+    verifier = RequestVerifier(
+        resolver, identity=SELLER_IDENTITY, nonces=MemoryNonceStore(), keys=CONFORMANCE_KEYS
+    )
+
+    async def go() -> str:
+        task = asyncio.ensure_future(verifier.verify(_signed()))
+        await asyncio.sleep(0)
+        task.cancel()
+        with contextlib.suppress(asyncio.CancelledError):
+            await task
+        return str((await verifier.verify(_signed())).origin)
+
+    assert asyncio.run(go()) == BUYER
+
+
+def test_a_resolver_belongs_to_the_loop_it_first_resolves_on(ports: dict[str, int]) -> None:
+    resolver = _resolver(ports)
+    verifier = RequestVerifier(
+        resolver, identity=SELLER_IDENTITY, nonces=MemoryNonceStore(), keys=CONFORMANCE_KEYS
+    )
+    assert asyncio.run(verifier.verify(_signed())).origin == BUYER_ORIGIN
+    with pytest.raises(ConfigurationError, match="another event loop"):
+        asyncio.run(verifier.verify(_signed()))
+
+
+def _in_a_forked_child(call: Callable[[], object]) -> str:
+    """Runs ``call`` in a forked child and returns what it ended with, as ``Type: message``.
+
+    The parent reads the child's answer until the child exits, with no
+    timeout: a call that hangs in the child hangs the test.
+    """
+    readable, writable = os.pipe()
+    with warnings.catch_warnings():
+        warnings.simplefilter("ignore", DeprecationWarning)  # fork with the runtime's thread
+        pid = os.fork()
+    if pid == 0:  # the child: report, and leave without running the parent's teardown
+        os.close(readable)
+        try:
+            call()
+            outcome = "returned"
+        except BaseException as e:  # the test reads whatever the child ended with
+            outcome = f"{type(e).__name__}: {e}"
+        os.write(writable, outcome.encode())
+        os._exit(0)
+    os.close(writable)
+    with os.fdopen(readable, "rb") as answer:
+        outcome = answer.read().decode()
+    os.waitpid(pid, 0)
+    return outcome
+
+
+def test_a_runtime_made_before_a_fork_refuses_the_childs_call_at_once() -> None:
+    # A pre-fork server (gunicorn --preload) builds the app, and the runtime, in the parent.
+    verifier = RequestVerifier(
+        StaticKeyResolver({BUYER_ORIGIN: [buyer_key()]}),
+        identity=SELLER_IDENTITY,
+        nonces=MemoryNonceStore(),
+        keys=CONFORMANCE_KEYS,
+    )
+    with SyncRuntime() as runtime:
+        sync = SyncRequestVerifier(verifier, runtime=runtime)
+        assert sync.verify(_signed()).origin == BUYER_ORIGIN
+        outcome = _in_a_forked_child(lambda: sync.verify(_signed()))
+        assert outcome.startswith("ConfigurationError: ") and "before a fork" in outcome
+        assert sync.verify(_signed()).origin == BUYER_ORIGIN  # the parent's runtime still runs
+
+
+def test_a_runtime_made_before_a_fork_and_never_used_refuses_the_child_too() -> None:
+    verifier = RequestVerifier(
+        StaticKeyResolver({BUYER_ORIGIN: [buyer_key()]}),
+        identity=SELLER_IDENTITY,
+        nonces=MemoryNonceStore(),
+        keys=CONFORMANCE_KEYS,
+    )
+    with SyncRuntime() as runtime:
+        sync = SyncRequestVerifier(verifier, runtime=runtime)
+
+        def call_then_close() -> None:
+            try:
+                sync.verify(_signed())
+            finally:
+                runtime.close()  # closing in the child leaves the parent's loop alone
+
+        outcome = _in_a_forked_child(call_then_close)
+        assert outcome.startswith("ConfigurationError: ") and "before a fork" in outcome
+        assert sync.verify(_signed()).origin == BUYER_ORIGIN
+
+
+def test_a_sync_client_made_before_a_fork_refuses_the_childs_request_at_once() -> None:
+    sellers_keys = StaticKeyResolver({SELLER_ORIGIN: [seller_key()]})
+    seller = _seller(ResponseSigner.of(seller_key(), SELLER))
+    with SyncRuntime() as runtime:
+        auth = WebBotAuth(
+            RequestSigner.of(buyer_key(), BUYER),
+            ResponseVerifier(sellers_keys, keys=CONFORMANCE_KEYS),
+            runtime=runtime,
+        )
+        with auth.client(transport=seller) as client:
+            assert verified_response(client.post(COMMIT_URL, json={})) is not None
+            outcome = _in_a_forked_child(lambda: client.post(COMMIT_URL, json={}))
+            assert outcome.startswith("ConfigurationError: ") and "before a fork" in outcome
+            assert verified_response(client.post(COMMIT_URL, json={})) is not None
diff --git a/tests/web_bot_auth/test_wba_target_uri.py b/tests/web_bot_auth/test_wba_target_uri.py
new file mode 100644
index 0000000..448cff4
--- /dev/null
+++ b/tests/web_bot_auth/test_wba_target_uri.py
@@ -0,0 +1,206 @@
+"""The URL every signature covers, ``@target-uri``, as it travels on the wire.
+
+The signer signs the URL an HTTP client sends, the server edge rebuilds the
+URL it received, and the verifier recomputes ``@target-uri`` and
+``@authority`` from it, all under one rule (:func:`target_uri`). So a URL
+with the characters clients send raw (``[ ] | ^ { }`` in a query), an
+escape in the path, a default port, a mixed-case host, or dot segments is
+signed, verified, and answered like any other, in process and on uvicorn.
+"""
+
+from __future__ import annotations
+
+import json
+
+import httpx
+import pytest
+
+from iab_agentic_primitives.web_bot_auth import (
+    CONFORMANCE_KEYS,
+    HTTPRequest,
+    MemoryNonceStore,
+    RequestSigner,
+    RequestVerifier,
+    ResponseVerifier,
+    ServerIdentity,
+    StaticKeyResolver,
+    TargetURI,
+    target_uri,
+)
+from iab_agentic_primitives.web_bot_auth.asgi import (
+    ASGIApp,
+    Receive,
+    RequirePolicy,
+    RequireSignatureMiddleware,
+    Scope,
+    Send,
+    verified_request,
+)
+from iab_agentic_primitives.web_bot_auth.httpx import (
+    WebBotAuth,
+    sent_request,
+    verified_response,
+)
+from iab_agentic_primitives.web_bot_auth.values import authority_of
+
+from . import support as w
+from .support import BUYER, BUYER_ORIGIN, SELLER, SELLER_IDENTITY
+
+#: Each URL as a caller writes it, and as it travels on the wire: the WHATWG
+#: serialization httpx and fetch send, normalized per RFC 3986 § 6.2.2.
+WIRE = [
+    (f"{SELLER}/p?ids[]=1", f"{SELLER}/p?ids[]=1"),
+    (f"{SELLER}/p?f=a|b", f"{SELLER}/p?f=a|b"),
+    (f"{SELLER}/p?q={{json}}", f"{SELLER}/p?q={{json}}"),
+    (f"{SELLER}/p?q=a^b", f"{SELLER}/p?q=a^b"),
+    (f"{SELLER}/proposals/a%20b", f"{SELLER}/proposals/a%20b"),
+    ("https://seller.example.com:443/proposals/p1", f"{SELLER}/proposals/p1"),
+    ("HTTPS://Seller.Example.COM/Proposals/p1", f"{SELLER}/Proposals/p1"),
+    (f"{SELLER}/x/../proposals/./p1", f"{SELLER}/proposals/p1"),
+    (f"{SELLER}/x/%2E%2e/p1", f"{SELLER}/p1"),
+    (f"{SELLER}/proposals/a b?q=x y", f"{SELLER}/proposals/a%20b?q=x%20y"),
+    (f"{SELLER}/a{{b}}`c?q='\"", f"{SELLER}/a%7Bb%7D%60c?q=%27%22"),
+    (f"{SELLER}/p%zz?q=%zz", f"{SELLER}/p%zz?q=%zz"),
+    (f"{SELLER}/a\\b?q=a\\b", f"{SELLER}/a/b?q=a\\b"),
+    (f"{SELLER}/café?q=é", f"{SELLER}/caf%C3%A9?q=%C3%A9"),
+    ("https://user:pw@seller.example.com/p?#terms", f"{SELLER}/p"),
+    ("https://seller.example.com", f"{SELLER}/"),
+    ("https://Bücher.example:8443/p", "https://xn--bcher-kva.example:8443/p"),
+    ("http://[2001:DB8::1]:80/p", "http://[2001:db8::1]/p"),
+]
+
+#: The URLs the review found unsignable, unverifiable, or answered 500, as written.
+REVIEWED = [written for written, _ in WIRE[:8]]
+
+
+@pytest.mark.parametrize(("written", "wire"), WIRE)
+def test_target_uri_is_the_url_as_it_travels_on_the_wire(written: str, wire: str) -> None:
+    assert target_uri(written) == wire
+    assert target_uri(wire) == wire
+    # httpx sends the path and query exactly as the rule writes them.
+    assert wire.endswith(httpx.URL(wire).raw_path.decode())
+    # @authority follows the same rule.
+    assert authority_of(written) == TargetURI.parse(wire).authority
+
+
+@pytest.mark.parametrize("url", ["/p", "seller.example.com/p", "ftp://seller.example.com/p", ""])
+def test_a_url_that_is_not_absolute_http_has_no_target_uri(url: str) -> None:
+    with pytest.raises(ValueError, match="not an absolute http or https URL"):
+        target_uri(url)
+
+
+# ── signed, verified, and answered ────────────────────────────────────────
+
+
+async def _echo(scope: Scope, receive: Receive, send: Send) -> None:
+    verified = verified_request(scope)
+    signed_by = None if verified is None else str(verified.origin)
+    headers = [(b"content-type", b"application/json")]
+    await send({"type": "http.response.start", "status": 200, "headers": headers})
+    await send(
+        {"type": "http.response.body", "body": json.dumps({"signed_by": signed_by}).encode()}
+    )
+
+
+def _seller(identity: ServerIdentity = SELLER_IDENTITY) -> ASGIApp:
+    """The seller: it verifies a signed request, passes an unsigned one, and signs every answer."""
+    keys = StaticKeyResolver({BUYER_ORIGIN: [w.buyer_key()]})
+    verifier = RequestVerifier(
+        keys, identity=identity, nonces=MemoryNonceStore(), keys=CONFORMANCE_KEYS
+    )
+    edge = w.seller_edge(verifier)
+    required = RequireSignatureMiddleware(_echo, edge, policy=RequirePolicy(on_unsigned="pass"))
+    return w.seller_signing(required, edge)
+
+
+def _response_verifier(identity: ServerIdentity = SELLER_IDENTITY) -> ResponseVerifier:
+    return ResponseVerifier(
+        StaticKeyResolver({identity.origin: [w.seller_key()]}), keys=CONFORMANCE_KEYS
+    )
+
+
+def _buyer(identity: ServerIdentity = SELLER_IDENTITY) -> WebBotAuth:
+    """The buyer: it signs every request and verifies every answer and its binding."""
+    return WebBotAuth(RequestSigner.of(w.buyer_key(), BUYER), _response_verifier(identity))
+
+
+def _browser(identity: ServerIdentity = SELLER_IDENTITY) -> WebBotAuth:
+    """A client that signs nothing and still verifies the seller's signed answer."""
+    return WebBotAuth.verify_only(_response_verifier(identity))
+
+
+@pytest.mark.parametrize("written", REVIEWED)
+def test_the_buyers_client_signs_and_verifies_each_url_through_the_edge(written: str) -> None:
+    async def get() -> httpx.Response:
+        transport = httpx.ASGITransport(app=_seller())
+        async with _buyer().async_client(transport=transport) as c:
+            return await c.get(written)
+
+    response = w.run(get())
+    assert response.status_code == 200 and response.json() == {"signed_by": BUYER}
+    verified = verified_response(response)
+    assert verified is not None and verified.bound
+    sent = sent_request(response)
+    assert sent is not None and sent.url == target_uri(written)
+
+
+@pytest.mark.parametrize("written", REVIEWED)
+def test_a_request_signed_for_any_client_verifies_at_the_url_it_returns(written: str) -> None:
+    signed = RequestSigner.of(w.buyer_key(), BUYER).sign(HTTPRequest("GET", written))
+    assert signed.url == target_uri(written)
+
+    async def get() -> httpx.Response:
+        async with httpx.AsyncClient(transport=httpx.ASGITransport(app=_seller())) as c:
+            return await c.get(signed.url, headers=signed.headers.items())
+
+    response = w.run(get())
+    assert response.status_code == 200 and response.json() == {"signed_by": BUYER}
+
+
+@pytest.mark.parametrize("written", REVIEWED)
+def test_an_unsigned_request_to_each_url_gets_a_signed_answer(written: str) -> None:
+    async def get() -> httpx.Response:
+        transport = httpx.ASGITransport(app=_seller())
+        async with _browser().async_client(transport=transport) as c:
+            return await c.get(written)
+
+    response = w.run(get())
+    assert response.status_code == 200 and response.json() == {"signed_by": None}
+    verified = verified_response(response)
+    assert verified is not None and not verified.bound
+
+
+# ── on a real server ──────────────────────────────────────────────────────
+
+#: The paths and queries a real HTTP server receives raw, the review's 500s among them.
+ON_THE_WIRE = [
+    "/p?ids[]=1",
+    "/p?f=a|b",
+    "/p?q={json}",
+    "/p?q=a^b",
+    "/proposals/a%20b",
+    "/p%zz?q=%zz",
+    "/x/../proposals/./p1",
+]
+
+
+def test_behind_response_signing_on_uvicorn_every_url_is_answered_and_verified() -> None:
+    port = w.free_port()
+    identity = ServerIdentity.from_config(f"http://127.0.0.1:{port}")
+
+    async def each(auth: WebBotAuth) -> list[httpx.Response]:
+        async with auth.async_client() as c:
+            return [await c.get(identity.base_url + path) for path in ON_THE_WIRE]
+
+    with w.serving(_seller(identity), port):
+        signed = w.run(each(_buyer(identity)))
+        unsigned = w.run(each(_browser(identity)))
+    for path, response in zip(ON_THE_WIRE, signed, strict=True):
+        assert response.status_code == 200, (path, response.text)
+        assert response.json() == {"signed_by": BUYER}, path
+        verified = verified_response(response)
+        assert verified is not None and verified.bound, path
+    for path, response in zip(ON_THE_WIRE, unsigned, strict=True):
+        assert response.status_code == 200, (path, response.text)
+        assert response.json() == {"signed_by": None}, path
+        assert verified_response(response) is not None, path
diff --git a/tests/web_bot_auth/test_wba_values.py b/tests/web_bot_auth/test_wba_values.py
new file mode 100644
index 0000000..05ee600
--- /dev/null
+++ b/tests/web_bot_auth/test_wba_values.py
@@ -0,0 +1,622 @@
+"""The contracts a caller relies on: the refusal table as sent, configuration
+errors, canonical origins, the server's authorities, and key selection.
+
+Each test goes through a public constructor, a signer and a verifier, or an
+edge. The ``type: ignore`` lines below are live: strict mypy checks this module
+in blocking mode, so if one of those calls ever type-checks,
+``warn_unused_ignores`` fails the gate.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import copy
+import dataclasses
+import json
+import pickle
+import random
+from collections.abc import Callable, Iterator, Mapping
+from contextlib import contextmanager
+from dataclasses import replace
+from typing import Literal
+
+import http_sf
+import httpx
+import pytest
+from fastapi import FastAPI
+
+from iab_agentic_primitives.web_bot_auth import (
+    CONFORMANCE_KEYS,
+    DIRECTORY_PATH,
+    CachePolicy,
+    ConfigurationError,
+    DirectoryPublisher,
+    DirectoryResolver,
+    Ed25519Key,
+    FetchLimits,
+    HeaderLines,
+    HTTPRequest,
+    HTTPResponse,
+    KeyPolicy,
+    MemoryDirectoryStore,
+    MemoryNonceStore,
+    Origin,
+    PublishPolicy,
+    Refusal,
+    RequestSigner,
+    RequestVerifier,
+    ResponseSigner,
+    ResponseVerifier,
+    ServerIdentity,
+    StaticKeyResolver,
+    WebBotAuthError,
+    accept_signature,
+    publish_directory,
+    refusal_response,
+    verify_directory,
+)
+from iab_agentic_primitives.web_bot_auth.asgi import (
+    DirectoryMiddleware,
+    RequirePolicy,
+    RequireSignatureMiddleware,
+    ResponseSigningMiddleware,
+    ServerEdge,
+    SigningPolicy,
+)
+from iab_agentic_primitives.web_bot_auth.fetcher import HttpxDirectoryFetcher
+from iab_agentic_primitives.web_bot_auth.httpx import WebBotAuth, verified_response
+from iab_agentic_primitives.web_bot_auth.rules import CONTENT_DIGEST, Streaming
+from iab_agentic_primitives.web_bot_auth.signer import SignerConfig
+from iab_agentic_primitives.web_bot_auth.sync import SyncRuntime
+from iab_agentic_primitives.web_bot_auth.testing import directory_transport
+
+from . import support as w
+from .support import expect_refusal
+
+STATUSES = {400, 403, 429, 503}
+
+# ── the refusal table ─────────────────────────────────────────────────────
+
+# Every refusal, with its code, status, Accept-Signature, and Retry-After.
+REFUSALS: dict[Refusal, tuple[str, int, bool, int | None]] = {
+    Refusal.PARSE: ("parse", 400, False, None),
+    Refusal.SIGNATURE_MISSING: ("signature-missing", 403, True, None),
+    Refusal.MULTIPLE_SIGNATURES: ("multiple-signatures", 403, True, None),
+    Refusal.SIGNATURE_AGENT_MISSING: ("signature-agent-missing", 403, True, None),
+    Refusal.MULTIPLE_SIGNATURE_AGENTS: ("multiple-signature-agents", 403, True, None),
+    Refusal.SIGNATURE_AGENT_PARAMETERS: ("signature-agent-parameters", 403, True, None),
+    Refusal.SIGNATURE_AGENT_NOT_COVERED: ("signature-agent-not-covered", 403, True, None),
+    Refusal.SIGNATURE_AGENT_VALUE: ("signature-agent-value", 403, True, None),
+    Refusal.KEYID: ("keyid", 403, True, None),
+    Refusal.ALG: ("alg", 403, True, None),
+    Refusal.WINDOW: ("window", 403, True, None),
+    Refusal.LIFETIME: ("lifetime", 403, True, None),
+    Refusal.CREATED_IN_FUTURE: ("created-in-future", 403, True, None),
+    Refusal.EXPIRED: ("expired", 403, True, None),
+    Refusal.NONCE_MISSING: ("nonce-missing", 403, True, None),
+    Refusal.NONCE_INVALID: ("nonce-invalid", 403, True, None),
+    Refusal.COMPONENTS: ("components", 403, True, None),
+    Refusal.CONTENT_DIGEST: ("content-digest", 403, True, None),
+    Refusal.AUTHORITY: ("authority", 403, True, None),
+    Refusal.REJECTED_KEY: ("rejected-key", 403, True, None),
+    Refusal.KEY_NOT_FOUND: ("key-not-found", 403, True, None),
+    Refusal.SIGNATURE_INVALID: ("signature-invalid", 403, True, None),
+    Refusal.RESPONSE_NOT_BOUND: ("response-not-bound", 403, True, None),
+    Refusal.ORIGIN_MISMATCH: ("origin-mismatch", 403, True, None),
+    Refusal.DIRECTORY_UNAVAILABLE: ("directory-unavailable", 403, True, None),
+    Refusal.DIRECTORY_STATUS: ("directory-status", 403, True, None),
+    Refusal.DIRECTORY_ENCODING: ("directory-encoding", 403, True, None),
+    Refusal.DIRECTORY_MEDIA_TYPE: ("directory-media-type", 403, True, None),
+    Refusal.DIRECTORY_TOO_LARGE: ("directory-too-large", 403, True, None),
+    Refusal.DIRECTORY_CONTENT_DIGEST: ("directory-content-digest", 403, True, None),
+    Refusal.DIRECTORY_FORMAT: ("directory-format", 403, True, None),
+    Refusal.DIRECTORY_TOO_MANY_KEYS: ("directory-too-many-keys", 403, True, None),
+    Refusal.DIRECTORY_KID: ("directory-kid", 403, True, None),
+    Refusal.DIRECTORY_NO_USABLE_KEY: ("directory-no-usable-key", 403, True, None),
+    Refusal.DIRECTORY_SIGNATURE_PARSE: ("directory-signature-parse", 403, True, None),
+    Refusal.DIRECTORY_ONE_SIGNATURE_PER_KEY: ("directory-one-signature-per-key", 403, True, None),
+    Refusal.DIRECTORY_TAG: ("directory-tag", 403, True, None),
+    Refusal.DIRECTORY_COMPONENTS: ("directory-components", 403, True, None),
+    Refusal.DIRECTORY_WINDOW: ("directory-window", 403, True, None),
+    Refusal.DIRECTORY_SIGNATURE: ("directory-signature", 403, True, None),
+    Refusal.NONCE_REPLAYED: ("nonce-replayed", 429, True, None),
+    Refusal.NONCE_STORE_UNAVAILABLE: ("nonce-store-unavailable", 503, False, 1),
+}
+
+
+def test_the_refusal_table_lists_every_member() -> None:
+    assert set(REFUSALS) == set(Refusal)
+    assert len({code for code, *_ in REFUSALS.values()}) == len(Refusal)
+
+
+@pytest.mark.parametrize("has_body", [True, False], ids=["body", "no-body"])
+@pytest.mark.parametrize("refusal", list(Refusal), ids=lambda r: r.code)
+def test_each_refusal_is_sent_with_its_code_status_and_headers(
+    refusal: Refusal, has_body: bool
+) -> None:
+    code, status, sends_accept_signature, retry_after = REFUSALS[refusal]
+    error = WebBotAuthError(refusal, "why it failed")
+    assert (error.refusal, error.status, error.reason, str(error)) == (
+        refusal,
+        status,
+        code,
+        "why it failed",
+    )
+    sent_status, headers, body = refusal_response(error, has_body=has_body)
+    assert sent_status == status and status in STATUSES
+    assert headers.get("content-type") == "application/json"
+    assert json.loads(body) == {"error": code, "status": status}
+    expected_accept = accept_signature(has_body=has_body) if sends_accept_signature else None
+    assert headers.get("accept-signature") == expected_accept
+    assert headers.get("retry-after") == (None if retry_after is None else str(retry_after))
+
+
+def test_a_status_outside_the_table_cannot_be_expressed() -> None:
+    # The error takes a Refusal, and only a Refusal has a status.
+    with pytest.raises(TypeError):
+        WebBotAuthError(500, "made-up-reason")  # type: ignore[arg-type]
+
+
+def test_a_credential_is_made_only_by_verifying() -> None:
+    verified = w.run(w.request_verifier().verify(w.sign_request()))
+    assert verified.origin == w.BUYER_ORIGIN
+    forgeries: list[Callable[[], object]] = [
+        lambda: dataclasses.replace(verified, origin=Origin.parse("https://victim.example.com")),
+        lambda: copy.copy(verified),
+        lambda: copy.deepcopy(verified),
+        lambda: pickle.dumps(verified),
+        lambda: type(verified)(),  # type: ignore[call-arg]
+    ]
+    for forge in forgeries:
+        with pytest.raises(TypeError):
+            forge()
+
+
+def test_the_covered_components_are_component_ids() -> None:
+    verified = w.run(w.request_verifier().verify(w.sign_request()))
+    assert CONTENT_DIGEST in verified.components
+
+
+def test_a_refusal_survives_pickle_and_copy() -> None:
+    error = WebBotAuthError(Refusal.NONCE_REPLAYED, "seen before")
+    for copied in (pickle.loads(pickle.dumps(error)), copy.copy(error), copy.deepcopy(error)):
+        assert isinstance(copied, WebBotAuthError)
+        assert (copied.refusal, copied.status, str(copied)) == (
+            Refusal.NONCE_REPLAYED,
+            429,
+            "seen before",
+        )
+
+
+# ── configuration errors ──────────────────────────────────────────────────
+
+BAD_ORIGIN = "https://Buyer.example.com"
+#: One key more than a directory may hold.
+SEVENTEEN_KEYS = [w.key(f"directory-{i}") for i in range(17)]
+
+
+def _app() -> FastAPI:
+    return FastAPI()
+
+
+CONSTRUCTORS: dict[str, Callable[[], object]] = {
+    "RequestSigner origin": lambda: RequestSigner.of(w.buyer_key(), BAD_ORIGIN),
+    "RequestSigner lifetime": lambda: RequestSigner(
+        SignerConfig(w.buyer_key(), Origin.parse(w.BUYER), lifetime=0)
+    ),
+    "ResponseSigner origin": lambda: ResponseSigner.of(w.seller_key(), "http://seller.example.com"),
+    "ResponseSigner lifetime": lambda: ResponseSigner(
+        SignerConfig(w.seller_key(), Origin.parse(w.SELLER), lifetime=301)
+    ),
+    "StaticKeyResolver": lambda: StaticKeyResolver({BAD_ORIGIN: [w.buyer_key()]}),
+    "Origin.parse": lambda: Origin.parse("https://buyer.example.com:443"),
+    "ServerIdentity.from_config": lambda: ServerIdentity.from_config("https://Seller.example.com"),
+    "ServerIdentity userinfo": lambda: ServerIdentity.from_config(
+        "https://user@seller.example.com"
+    ),
+    "ServerIdentity non-ASCII port": lambda: ServerIdentity.from_config(
+        "https://seller.example.com:\u00b2"
+    ),
+    "ServerIdentity direct, another scheme": lambda: ServerIdentity(
+        Origin.parse("https://a.example.com"), "ftp://b.example.com/x?y"
+    ),
+    "ServerIdentity direct, another host": lambda: ServerIdentity(
+        Origin.parse("https://a.example.com"), "https://b.example.com"
+    ),
+    "CachePolicy max_cache_age str": lambda: CachePolicy(max_cache_age="300"),  # type: ignore[arg-type]
+    "CachePolicy max_cache_age -1": lambda: CachePolicy(max_cache_age=-1),
+    "CachePolicy negative_ttl -60": lambda: CachePolicy(negative_ttl=-60),
+    "MemoryDirectoryStore max_entries": lambda: MemoryDirectoryStore(max_entries=0),
+    "FetchLimits max_bytes": lambda: FetchLimits(max_bytes=-1),
+    "FetchLimits max_keys": lambda: FetchLimits(max_keys=0),
+    "FetchLimits total_timeout": lambda: FetchLimits(total_timeout=-1),
+    "FetchLimits connect_timeout bool": lambda: FetchLimits(connect_timeout=True),
+    "DirectoryResolver limits": lambda: DirectoryResolver(
+        limits="profile"  # type: ignore[arg-type]
+    ),
+    "MemoryNonceStore max_entries": lambda: MemoryNonceStore(max_entries=0),
+    "MemoryNonceStore max_entries type": lambda: MemoryNonceStore(max_entries="1"),  # type: ignore[arg-type]
+    "DirectoryMiddleware": lambda: DirectoryMiddleware(
+        _app(),
+        [w.seller_key()],  # type: ignore[arg-type]
+    ),
+    "DirectoryPublisher origin": lambda: DirectoryPublisher(
+        w.SELLER,  # type: ignore[arg-type]
+        [w.seller_key()],
+    ),
+    "DirectoryPublisher no keys": lambda: DirectoryPublisher(w.SELLER_ORIGIN, []),
+    "DirectoryPublisher a key twice": lambda: DirectoryPublisher(
+        w.SELLER_ORIGIN, [w.seller_key(), w.seller_key()]
+    ),
+    "DirectoryPublisher 17 keys": lambda: DirectoryPublisher(w.SELLER_ORIGIN, SEVENTEEN_KEYS),
+    "PublishPolicy lifetime -1": lambda: PublishPolicy(lifetime=-1),
+    "PublishPolicy lifetime 0": lambda: PublishPolicy(lifetime=0),
+    "PublishPolicy lifetime True": lambda: PublishPolicy(lifetime=True),
+    "publish_directory no keys": lambda: publish_directory(w.SELLER_ORIGIN, [], now=w.T0),
+    "publish_directory a key twice": lambda: publish_directory(
+        w.SELLER_ORIGIN, [w.seller_key(), w.seller_key()], now=w.T0
+    ),
+    "publish_directory 17 keys": lambda: publish_directory(
+        w.SELLER_ORIGIN, SEVENTEEN_KEYS, now=w.T0
+    ),
+    "ServerEdge identity": lambda: ServerEdge(
+        w.SELLER,  # type: ignore[arg-type]
+        signer=ResponseSigner.of(w.seller_key(), w.SELLER),
+        publisher=DirectoryPublisher(w.SELLER_ORIGIN, [w.seller_key()]),
+    ),
+    "ServerEdge another directory": lambda: ServerEdge(
+        w.SELLER_IDENTITY,
+        signer=ResponseSigner.of(w.seller_key(), w.SELLER),
+        publisher=DirectoryPublisher(w.OTHER_ORIGIN, [w.seller_key()]),
+    ),
+    "ServerEdge unpublished key": lambda: ServerEdge(
+        w.SELLER_IDENTITY,
+        signer=ResponseSigner.of(w.seller_key(), w.SELLER),
+        publisher=DirectoryPublisher(w.SELLER_ORIGIN, [w.other_key()]),
+    ),
+    "ResponseSigningMiddleware edge": lambda: ResponseSigningMiddleware(
+        _app(),
+        w.SELLER_IDENTITY,  # type: ignore[arg-type]
+    ),
+    "RequireSignatureMiddleware edge without a confirmer": lambda: RequireSignatureMiddleware(
+        _app(), w.seller_edge()
+    ),
+    "SigningPolicy max_body_bytes": lambda: SigningPolicy(max_body_bytes=-1),
+    "Streaming media_types": lambda: Streaming("text/event-stream"),  # type: ignore[arg-type]
+    "SigningPolicy streaming": lambda: SigningPolicy(
+        streaming=("text/event-stream",)  # type: ignore[arg-type]
+    ),
+    "RequirePolicy max_body_bytes": lambda: RequirePolicy(max_body_bytes=True),
+    "WebBotAuth expect": lambda: WebBotAuth(
+        None,
+        ResponseVerifier(StaticKeyResolver({}), keys=CONFORMANCE_KEYS),
+        expect=w.SELLER,  # type: ignore[arg-type]
+    ),
+    "WebBotAuth streaming": lambda: WebBotAuth(
+        None,
+        ResponseVerifier(StaticKeyResolver({}), keys=CONFORMANCE_KEYS),
+        streaming=("application/x-ndjson",),  # type: ignore[arg-type]
+    ),
+}
+
+
+@pytest.mark.parametrize("name", list(CONSTRUCTORS))
+def test_bad_configuration_raises_configuration_error(name: str) -> None:
+    # A misconfiguration fails at construction, as a ValueError, and is never a refusal.
+    with pytest.raises(ConfigurationError) as e:
+        CONSTRUCTORS[name]()
+    assert isinstance(e.value, ValueError) and not isinstance(e.value, WebBotAuthError)
+
+
+def test_a_key_seed_is_32_bytes() -> None:
+    with pytest.raises(ValueError, match="32 bytes"):
+        Ed25519Key.from_seed(b"short")
+
+
+def test_an_identifier_set_is_not_a_bare_string() -> None:
+    kid = w.buyer_key().thumbprint
+    with pytest.raises(ConfigurationError):
+        KeyPolicy(reject_keyids=kid)
+    with pytest.raises(ConfigurationError):
+        KeyPolicy(accept_test_keys="yes")  # type: ignore[arg-type]
+    with pytest.raises(ConfigurationError):
+        ResponseVerifier(StaticKeyResolver({}), keys={kid})  # type: ignore[arg-type]
+
+
+# ── canonical origins ─────────────────────────────────────────────────────
+
+BAD_HOSTS = [
+    "http://buyer.example.com",
+    "https://BUYER.example.com",
+    "HTTPS://buyer.example.com",
+    "https://buyer.example.com:443",
+    "https://buyer.example.com:8443",
+    "https://user@buyer.example.com",
+    "https://b\u00fccher.example.com",
+    "https://2130706433",
+    "https://127.1",
+    "https://1.2.3.04",
+    "https://0x7f.0.0.1",
+    "https://seller.0x10",
+    "https://[fe80::1%en0]",
+    "https://",
+    "buyer.example.com",
+]
+
+
+@pytest.mark.parametrize(
+    "value", ["https://buyer.example.com", "https://[::1]", "https://127.0.0.1", "https://a"]
+)
+def test_an_origin_is_exactly_https_and_a_canonical_host(value: str) -> None:
+    origin = Origin.parse(value)
+    assert str(origin) == value
+    assert origin.host == origin.authority == value[len("https://") :]
+    assert origin.directory_url == value + DIRECTORY_PATH
+
+
+@pytest.mark.parametrize(
+    "value",
+    [
+        *BAD_HOSTS,
+        "https://buyer.example.com/",
+        "https://buyer.example.com/agents/a",
+        "https://buyer.example.com?x=1",
+        "https://buyer.example.com#f",
+        "https://buyer.example.com" + DIRECTORY_PATH,
+        "",
+        42,
+    ],
+)
+def test_a_non_canonical_origin_is_a_configuration_error(value: object) -> None:
+    with pytest.raises(ConfigurationError):
+        Origin.parse(value)
+
+
+# ── the server's authority ────────────────────────────────────────────────
+
+
+@pytest.mark.parametrize(
+    ("url", "refusal"),
+    [
+        ("https://seller.example.com:8443/proposals", None),
+        ("https://Seller.Example.COM:8443/proposals?x=1", None),
+        ("https://seller.example.com/proposals", Refusal.AUTHORITY),
+        ("https://seller.example.com:9443/proposals", Refusal.AUTHORITY),
+        ("ftp://seller.example.com:8443/proposals", Refusal.AUTHORITY),
+    ],
+)
+def test_a_server_on_a_port_answers_for_its_base_urls_authority_alone(
+    url: str, refusal: Refusal | None
+) -> None:
+    # The authority normalizes as @authority does: a lowercase host, no default port.
+    identity = ServerIdentity.from_config("https://seller.example.com:8443")
+    verifier = RequestVerifier(
+        StaticKeyResolver({w.BUYER: [w.buyer_key()]}),
+        identity=identity,
+        nonces=MemoryNonceStore(clock=lambda: w.T0),
+        clock=lambda: w.T0,
+        keys=CONFORMANCE_KEYS,
+    )
+    # A signer signs only http and https URLs, so the ftp URL is presented, not signed.
+    signable = url.replace("ftp://", "https://")
+    signer = RequestSigner.of(w.buyer_key(), w.BUYER)
+    signed = replace(signer.sign(HTTPRequest("GET", signable), now=w.T0), url=url)
+    if refusal is None:
+        assert w.run(verifier.verify(signed)).origin == w.BUYER_ORIGIN
+    else:
+        expect_refusal(lambda: verifier.verify(signed), refusal)
+
+
+# ── key selection by (origin, kid) on a warm cache ────────────────────────
+
+
+def _verify(verifier: RequestVerifier, request: HTTPRequest) -> Origin:
+    verified = w.run(verifier.verify(request, now=w.T0))
+    return verified.origin
+
+
+def _verifier(resolver: DirectoryResolver) -> RequestVerifier:
+    return RequestVerifier(
+        resolver,
+        identity=w.SELLER_IDENTITY,
+        nonces=MemoryNonceStore(clock=lambda: w.T0),
+        clock=lambda: w.T0,
+        keys=CONFORMANCE_KEYS,
+    )
+
+
+def _directories(buyer: Ed25519Key, other: Ed25519Key) -> httpx.MockTransport:
+    return directory_transport(
+        {
+            w.BUYER_ORIGIN: w.signed_directory(w.BUYER, [buyer]),
+            w.OTHER_ORIGIN: w.signed_directory(w.OTHER, [other]),
+        }
+    )
+
+
+def _claims_other(buyer: Ed25519Key) -> HTTPRequest:
+    """A commit signed with the buyer's key whose Signature-Agent names OTHER."""
+    return w.signed_commit(buyer, w.OTHER)
+
+
+def test_a_warm_cache_keys_on_origin_and_kid() -> None:
+    buyer, other = w.buyer_key(), w.other_key()
+    verifier = _verifier(
+        DirectoryResolver(
+            HttpxDirectoryFetcher(transport=_directories(buyer, other)), clock=lambda: w.T0
+        )
+    )
+    assert _verify(verifier, w.signed_commit(buyer)) == w.BUYER_ORIGIN
+    expect_refusal(lambda: _verify(verifier, _claims_other(buyer)), Refusal.KEY_NOT_FOUND)
+
+
+def test_a_shared_cache_keys_on_origin_and_kid() -> None:
+    buyer, other = w.buyer_key(), w.other_key()
+    store = MemoryDirectoryStore()
+    first, second = (
+        _verifier(
+            DirectoryResolver(
+                HttpxDirectoryFetcher(transport=_directories(buyer, other)),
+                store=store,
+                clock=lambda: w.T0,
+            )
+        )
+        for _ in range(2)
+    )
+    assert _verify(first, w.signed_commit(buyer)) == w.BUYER_ORIGIN
+    assert asyncio.run(store.get(w.BUYER_ORIGIN)) is not None
+    assert asyncio.run(store.get(w.OTHER_ORIGIN)) is None
+    expect_refusal(lambda: _verify(second, _claims_other(buyer)), Refusal.KEY_NOT_FOUND)
+
+
+def test_a_cache_warmed_in_the_other_order_keys_on_origin_and_kid() -> None:
+    # OTHER's directory is cached first, then BUYER's; BUYER's key still names only BUYER.
+    buyer, other = w.buyer_key(), w.other_key()
+    resolver = DirectoryResolver(
+        HttpxDirectoryFetcher(transport=_directories(buyer, other)), clock=lambda: w.T0
+    )
+    verifier = _verifier(resolver)
+    assert _verify(verifier, w.signed_commit(other, w.OTHER)) == w.OTHER_ORIGIN
+    assert _verify(verifier, w.signed_commit(buyer)) == w.BUYER_ORIGIN
+    expect_refusal(lambda: _verify(verifier, _claims_other(buyer)), Refusal.KEY_NOT_FOUND)
+
+
+# ── the httpx edge's expected origin ──────────────────────────────────────
+
+
+def _seller_on(url_port: int, seller: Ed25519Key) -> httpx.MockTransport:
+    signer = ResponseSigner(SignerConfig(seller, w.SELLER_ORIGIN, clock=lambda: w.T0))
+
+    def handler(request: httpx.Request) -> httpx.Response:
+        assert request.url.port == url_port
+        body = b'{"ok":true}'
+        incoming = HTTPRequest(request.method, str(request.url), request.headers.multi_items())
+        signed = signer.sign(HTTPResponse(200, w.JSON, body, incoming))
+        return httpx.Response(200, headers=signed.headers.items(), content=body)
+
+    return httpx.MockTransport(handler)
+
+
+@pytest.mark.parametrize("expect", [w.SELLER_ORIGIN, "same-origin"])
+def test_a_response_from_another_port_verifies_as_the_hosts_identity(
+    expect: Origin | Literal["same-origin"],
+) -> None:
+    seller = w.seller_key()
+    resolver = DirectoryResolver(
+        HttpxDirectoryFetcher(
+            transport=directory_transport({w.SELLER_ORIGIN: w.signed_directory(w.SELLER, [seller])})
+        ),
+        clock=lambda: w.T0,
+    )
+    with SyncRuntime(resolver) as runtime:
+        verifier = ResponseVerifier(resolver, clock=lambda: w.T0, keys=CONFORMANCE_KEYS)
+        auth = WebBotAuth.verify_only(verifier, runtime=runtime, expect=expect)
+        with auth.client(transport=_seller_on(8443, seller)) as client:
+            response = client.get("https://seller.example.com:8443/proposals/prop_7")
+    verified = verified_response(response)
+    assert verified is not None and verified.origin == w.SELLER_ORIGIN
+
+
+# ── only typed refusals escape ────────────────────────────────────────────
+
+_ALPHABET = '!"#$%(),-./:;<=>?@[]_{}=;"0123456789abcdefABCDEF sig1key\té'
+
+
+def _mutate(value: str, rng: random.Random) -> str:
+    """One random edit: delete, insert, duplicate, or truncate."""
+    if not value:
+        return rng.choice(_ALPHABET)
+    i = rng.randrange(len(value))
+    edit = rng.randrange(4)
+    if edit == 0:
+        return value[:i] + value[i + 1 :]
+    if edit == 1:
+        return value[:i] + rng.choice(_ALPHABET) + value[i:]
+    if edit == 2:
+        j = rng.randrange(i, len(value) + 1)
+        return value[:j] + value[i:j] + value[j:]
+    return value[:i]
+
+
+def _mutations(
+    headers: dict[str, str], names: tuple[str, ...], seed: int, count: int
+) -> Iterator[dict[str, str]]:
+    rng = random.Random(seed)
+    for _ in range(count):
+        mutated = dict(headers)
+        for _ in range(rng.randrange(1, 4)):
+            name = rng.choice([n for n in mutated if n.lower() in names] or [names[0]])
+            mutated[name] = _mutate(mutated.get(name, ""), rng)
+        yield mutated
+
+
+def _fields(headers: Mapping[str, str], names: tuple[str, ...]) -> dict[str, object]:
+    """The fields ``names`` of ``headers`` as Structured Fields parse them; ``None`` if not."""
+    parsed: dict[str, object] = {}
+    for name, value in headers.items():
+        if name.lower() in names:
+            try:
+                parsed[name.lower()] = http_sf.parse(value.encode(), tltype="dictionary")
+            except (http_sf.StructuredFieldError, UnicodeEncodeError):
+                parsed[name.lower()] = None
+    return parsed
+
+
+@contextmanager
+def _only_refusals(
+    original: Mapping[str, str],
+    mutated: Mapping[str, str],
+    names: tuple[str, ...] = ("signature", "signature-input", "signature-agent"),
+) -> Iterator[None]:
+    """Requires a typed refusal with a status from the table, unless the mutation left the
+    signature fields as they were: a changed message never verifies, and nothing else escapes."""
+    try:
+        yield
+    except WebBotAuthError as e:
+        assert e.status in STATUSES, e
+    else:
+        assert _fields(mutated, names) == _fields(original, names), "a mutated message verified"
+
+
+FIELDS = ("signature", "signature-input", "signature-agent")
+
+
+def test_mutated_request_headers_raise_only_refusals() -> None:
+    buyer, other = w.buyer_key(), w.other_key()
+    verifier = _verifier(
+        DirectoryResolver(
+            HttpxDirectoryFetcher(transport=_directories(buyer, other)), clock=lambda: w.T0
+        )
+    )
+    request = w.signed_commit(buyer)
+    original = dict(request.headers)
+    for mutated in _mutations(original, FIELDS, seed=1, count=600):
+        with _only_refusals(original, mutated):
+            w.run(verifier.verify(replace(request, headers=HeaderLines(mutated)), now=w.T0))
+
+
+def test_mutated_response_headers_raise_only_refusals() -> None:
+    seller = w.seller_key()
+    resolver = DirectoryResolver(
+        HttpxDirectoryFetcher(
+            transport=directory_transport({w.SELLER_ORIGIN: w.signed_directory(w.SELLER, [seller])})
+        ),
+        clock=lambda: w.T0,
+    )
+    verifier = ResponseVerifier(resolver, clock=lambda: w.T0, keys=CONFORMANCE_KEYS)
+    request = w.signed_commit(w.buyer_key())
+    sent, headers = w.signed_result(seller, request)
+    original = dict(headers.items())
+    for mutated in _mutations(original, FIELDS, seed=2, count=600):
+        with _only_refusals(original, mutated):
+            response = HTTPResponse(200, mutated, w.COMMIT_RESULT_BODY, sent)
+            w.run(verifier.verify(response, now=w.T0))
+
+
+def test_mutated_directory_headers_raise_only_refusals() -> None:
+    status, lines, body = w.signed_directory(w.BUYER, [w.buyer_key(), w.other_key()])
+    headers = dict(lines.items())
+    names = ("signature", "signature-input", "content-digest")
+    for mutated in _mutations(headers, names, seed=3, count=600):
+        with _only_refusals(headers, mutated, names):
+            verify_directory(w.fetched(status, mutated, body), w.BUYER_ORIGIN, w.T0)
diff --git a/tests/web_bot_auth/test_wba_vectors.py b/tests/web_bot_auth/test_wba_vectors.py
new file mode 100644
index 0000000..72411cf
--- /dev/null
+++ b/tests/web_bot_auth/test_wba_vectors.py
@@ -0,0 +1,478 @@
+"""The committed conformance vectors, the generator, the runner, and the adapters."""
+
+from __future__ import annotations
+
+import base64
+import hashlib
+import json
+import re
+import shutil
+import subprocess
+import sys
+import zipfile
+from dataclasses import replace
+from pathlib import Path
+
+import http_sf
+import pytest
+from cryptography.hazmat.primitives.asymmetric.ed25519 import Ed25519PublicKey
+from pydantic import ValidationError
+
+from iab_agentic_primitives.web_bot_auth import HeaderLines, Refusal, thumbprint
+from iab_agentic_primitives.web_bot_auth.conformance import (
+    PROTOCOL,
+    VECTORS,
+    CommandAdapter,
+    LibraryAdapter,
+    generate,
+    keys_document,
+    meets,
+    published_key_ids,
+    published_keys,
+    run_conformance,
+    scenarios_document,
+    vector_operation,
+    vectors,
+)
+from iab_agentic_primitives.web_bot_auth.conformance.adapter import Adapter
+from iab_agentic_primitives.web_bot_auth.conformance.fixtures import DOC_URL
+from iab_agentic_primitives.web_bot_auth.conformance.models import (
+    KeyEntry,
+    Operation,
+    RefusalsDocument,
+    Refused,
+    Refuses,
+    RequestDoc,
+    Result,
+    Vector,
+    Verified,
+    VerifyDirectory,
+    VerifyRequest,
+    VerifyResponse,
+    read,
+)
+from iab_agentic_primitives.web_bot_auth.conformance.signing import sign_directory
+
+from .support import BUYER, OTHER, T0, at, key, vector_message, vector_request
+from .support import b64url_bytes as b64url_decode
+
+ALL = dict(vectors())
+POSITIVE = {vid: v for vid, v in ALL.items() if vid.startswith("positive/")}
+NEGATIVE = {vid: v for vid, v in ALL.items() if vid.startswith("negative/")}
+KEYS = keys_document().keys
+ROOT = Path(__file__).resolve().parents[2]
+
+
+def _library(op: Operation) -> Result:
+    return LibraryAdapter()(op)
+
+
+# ── the files ─────────────────────────────────────────────────────────────
+
+
+def test_committed_files_match_the_generator() -> None:
+    assert not generate.check()
+
+
+def test_a_stale_vector_file_fails_the_check_and_regenerating_deletes_it(tmp_path: Path) -> None:
+    copy = tmp_path / "vectors"
+    shutil.copytree(generate.SOURCE, copy)
+    (copy / "negative" / "099-stale.json").write_text("{}")
+    assert generate.check(copy).unknown == ("negative/099-stale.json",)
+    generate.write(copy)
+    assert not (copy / "negative" / "099-stale.json").exists()
+    assert not generate.check(copy)
+
+
+def test_regenerating_touches_only_the_generators_own_files(tmp_path: Path) -> None:
+    copy = tmp_path / "vectors"
+    shutil.copytree(generate.SOURCE, copy)
+    (copy / "package.json").write_text("{}")
+    (copy / "notes").mkdir()
+    (copy / "notes" / "settings.json").write_text("{}")
+    (copy / "scenarios.json").unlink()
+    assert generate.check(copy).missing == ("scenarios.json",)
+    generate.write(copy)
+    assert (copy / "package.json").exists() and (copy / "notes" / "settings.json").exists()
+    assert not generate.check(copy)
+
+
+def test_regenerating_refuses_a_directory_that_is_not_a_vector_directory(tmp_path: Path) -> None:
+    (tmp_path / "package.json").write_text("{}")
+    with pytest.raises(ValueError, match="not a vector directory"):
+        generate.write(tmp_path)
+    assert [p.name for p in tmp_path.iterdir()] == ["package.json"]
+
+
+def test_an_edited_vector_file_fails_the_check(tmp_path: Path) -> None:
+    copy = tmp_path / "vectors"
+    shutil.copytree(generate.SOURCE, copy)
+    edited = copy / "positive" / "001-single-signer-request.json"
+    edited.write_text(edited.read_text().replace('"tier": "wba"', '"tier": "profile"'))
+    assert generate.check(copy).differs == ("positive/001-single-signer-request.json",)
+
+
+def test_a_vector_whose_operation_signs_fails_to_load() -> None:
+    # A vector is graded by a verification; its operation names which.
+    document = json.loads((VECTORS / "positive" / "001-single-signer-request.json").read_text())
+    document["operation"]["op"] = "sign_request"
+    with pytest.raises(ValidationError, match="op"):
+        read(Vector, json.dumps(document))
+
+
+@pytest.mark.parametrize(
+    ("member", "value"),
+    [("ok", 1), ("ok", "yes"), ("status", 403.0), ("status", 500), ("status", 429)],
+)
+def test_an_outcome_is_read_strictly(member: str, value: object) -> None:
+    # JSON booleans and integers, and the rule's own status.
+    document = json.loads((VECTORS / "negative" / "001-missing-nonce.json").read_text())
+    document["expected"][member] = value
+    with pytest.raises(ValidationError):
+        read(Vector, json.dumps(document))
+
+
+def test_a_refusal_without_its_rule_fails_to_load() -> None:
+    document = json.loads((VECTORS / "negative" / "001-missing-nonce.json").read_text())
+    del document["expected"]["rule"]
+    with pytest.raises(ValidationError, match="rule"):
+        read(Vector, json.dumps(document))
+
+
+def test_the_refusal_vocabulary_is_the_refusal_enum() -> None:
+    vocabulary = read(RefusalsDocument, (VECTORS / "refusals.json").read_text())
+    assert [(r.rule, r.status) for r in vocabulary.refusals] == [
+        (r.code, r.status) for r in Refusal
+    ]
+
+
+def test_vectors_and_the_protocol_are_package_data() -> None:
+    assert {p.name for p in VECTORS.iterdir()} >= {
+        "keys.json",
+        "scenarios.json",
+        "refusals.json",
+        "positive",
+        "negative",
+        "README.md",
+    }
+    protocol = PROTOCOL.read_text()
+    assert "refusals.json" in protocol
+    assert all(str(status) in protocol for status in (400, 403, 429, 503))
+
+
+def test_the_wheel_ships_the_protocol_and_the_vectors(tmp_path: Path) -> None:
+    subprocess.run(
+        ["uv", "build", "--wheel", "--out-dir", str(tmp_path), str(ROOT)],
+        capture_output=True,
+        check=True,
+    )
+    (wheel,) = tmp_path.glob("*.whl")
+    names = set(zipfile.ZipFile(wheel).namelist())
+    package = "iab_agentic_primitives/web_bot_auth"
+    assert f"{package}/conformance/PROTOCOL.md" in names
+    assert f"{package}/vectors/refusals.json" in names
+    assert f"{package}/vectors/negative/001-missing-nonce.json" in names
+
+
+@pytest.mark.parametrize("entry", KEYS, ids=lambda k: k.seed_name)
+def test_each_key_derives_from_its_seed_and_kid_is_its_thumbprint(entry: KeyEntry) -> None:
+    seed = hashlib.sha256(f"aamp-wba-test/{entry.seed_name}".encode()).digest()
+    assert b64url_decode(entry.private_d) == seed
+    # The suite's own keys are these keys: support derives them from the same seed names.
+    assert key(entry.seed_name).thumbprint == entry.kid
+    assert entry.kid == thumbprint({"kty": entry.kty, "crv": entry.crv, "x": entry.x})
+    assert published_keys()[entry.kid].public_jwk()["x"] == entry.x
+    assert entry.identity.host.endswith(".example.com")
+
+
+def test_published_key_ids() -> None:
+    assert published_key_ids() == {k.kid for k in KEYS}
+
+
+def _signatures(vector: Vector) -> dict[str, bytes]:
+    value = vector_message(vector).headers["Signature"]
+    members = http_sf.parse(value.encode(), tltype="dictionary")
+    assert isinstance(members, dict)
+    out = {}
+    for label, member in members.items():
+        assert isinstance(member, tuple) and isinstance(member[0], bytes)
+        out[label] = member[0]
+    return out
+
+
+def _keyids(vector: Vector) -> dict[str, str]:
+    value = vector_message(vector).headers["Signature-Input"]
+    members = http_sf.parse(value.encode(), tltype="dictionary")
+    assert isinstance(members, dict)
+    out = {}
+    for label, member in members.items():
+        assert isinstance(member, tuple) and isinstance(member[1], dict)
+        out[label] = str(member[1]["keyid"])
+    return out
+
+
+@pytest.mark.parametrize("vid", [v for v, d in ALL.items() if d.expected_signature_base])
+def test_each_committed_signature_signs_its_expected_base(vid: str) -> None:
+    vector = ALL[vid]
+    assert vector.expected_signature_base is not None
+    by_kid = {k.kid: k for k in KEYS}
+    signatures, keyids = _signatures(vector), _keyids(vector)
+    for label, base in vector.expected_signature_base.items():
+        public = Ed25519PublicKey.from_public_bytes(b64url_decode(by_kid[keyids[label]].x))
+        public.verify(signatures[label], base.encode())
+
+
+def _headings() -> set[str]:
+    def slug(heading: str) -> str:
+        return re.sub(r"\s", "-", re.sub(r"[^\w\s-]", "", heading.strip().lower()))
+
+    doc = (ROOT / "WEB_BOT_AUTH.md").read_text()
+    return {slug(line.lstrip("#")) for line in doc.splitlines() if line.startswith("#")}
+
+
+def test_every_spec_reference_resolves_to_a_heading_of_the_doc() -> None:
+    references = [v.spec_reference for v in ALL.values()]
+    references.append(scenarios_document().spec_reference)
+    for reference in references:
+        url, anchor = reference.split("#", 1)
+        assert url == DOC_URL
+        assert anchor in _headings(), reference
+
+
+@pytest.mark.parametrize("vid", sorted(ALL))
+def test_each_vector_declares_its_kind_tier_and_spec(vid: str) -> None:
+    vector = ALL[vid]
+    entry = next(e for e in generate.VECTORS_REGISTRY if e.path == f"{vid}.json")
+    assert (vector.tier, vector.spec) == (entry.tier, "OpenProposal 3.0 § 2.8")
+    assert isinstance(vector.operation, (VerifyRequest, VerifyResponse, VerifyDirectory))
+
+
+def test_vector_hosts_are_under_example_com() -> None:
+    for path in generate.SOURCE.rglob("*.json"):
+        text = path.read_text()
+        assert ".test" not in text.replace("_test_", "").replace("test_harness", ""), path.name
+
+
+# ── the library on the vectors ────────────────────────────────────────────
+
+
+@pytest.mark.parametrize("vid", sorted(POSITIVE))
+def test_positive_vectors_verify_and_name_their_identity(vid: str) -> None:
+    vector = POSITIVE[vid]
+    got = _library(vector_operation(vector))
+    assert meets(vector.expected, got), got
+
+
+@pytest.mark.parametrize("vid", sorted(NEGATIVE))
+def test_negative_vectors_are_refused_for_their_rule(vid: str) -> None:
+    vector = NEGATIVE[vid]
+    expected = vector.expected
+    assert isinstance(expected, Refuses)
+    got = _library(vector_operation(vector))
+    assert isinstance(got, Refused), got
+    assert (got.status, got.rule) == (expected.status, expected.rule.code)
+
+
+def test_004_verifies_when_the_named_origin_publishes_the_key() -> None:
+    vector = NEGATIVE["negative/004-key-not-in-named-directory"]
+    op = vector_operation(vector)
+    assert isinstance(op, VerifyRequest)
+    buyer_kid = next(k.kid for k in KEYS if str(k.identity) == BUYER)
+    other = {OTHER: sign_directory([published_keys()[buyer_kid]], OTHER, vector.reference_now)}
+    got = _library(replace(op, directories=other))
+    assert got == Verified(identity=OTHER, keyid=buyer_kid, body_covered=True)
+
+
+def _only_member(value: str, label: str) -> str:
+    members = http_sf.parse(value.encode(), tltype="dictionary")
+    assert isinstance(members, dict)
+    return http_sf.ser({label: members[label]})
+
+
+def test_006_each_signature_verifies_on_its_own() -> None:
+    vector = NEGATIVE["negative/006-two-signatures"]
+    first = POSITIVE["positive/001-single-signer-request"]
+    assert vector.expected_signature_base and first.expected_signature_base
+    assert vector.expected_signature_base["sig1"] == first.expected_signature_base["sig1"]
+    op = vector_operation(vector)
+    assert isinstance(op, VerifyRequest)
+    headers = op.request.headers
+    for label, origin in (("sig1", BUYER), ("sig2", OTHER)):
+        only = dict(headers.items())
+        for name in ("Signature-Input", "Signature", "Signature-Agent"):
+            only[name] = _only_member(headers[name], label)
+        got = _library(replace(op, request=replace(op.request, headers=HeaderLines(only))))
+        assert isinstance(got, Verified) and got.identity == origin, got
+
+
+def test_002_is_positive_001_sent_again_after_001() -> None:
+    replayed = NEGATIVE["negative/002-replayed-nonce"].operation
+    assert isinstance(replayed, VerifyRequest)
+    assert replayed.request == vector_request(POSITIVE["positive/001-single-signer-request"])
+    assert replayed.prior == (replayed.request,)
+
+
+def test_positive_001_body_is_an_openproposal_commit() -> None:
+    request = vector_request(POSITIVE["positive/001-single-signer-request"])
+    body = json.loads(request.body)
+    assert request.url == "https://seller.example.com/proposals/prop_7/commit"
+    assert body["entry"]["role"] == "commitment"
+    assert set(body["writes"]) == set(body["entry"]["line_item_ids"])
+    digest = base64.b64encode(hashlib.sha256(request.body).digest()).decode()
+    assert request.headers["Content-Digest"] == f"sha-256=:{digest}:"
+    response = vector_message(POSITIVE["positive/003-signed-response"])
+    assert [e["role"] for e in json.loads(response.body)["entries"]] == ["commitment", "acceptance"]
+
+
+def test_reference_now_is_the_fixed_clock() -> None:
+    assert {v.reference_now for v in ALL.values()} <= {at(10), at(15)}
+
+
+# ── the runner grades by rule ─────────────────────────────────────────────
+
+
+def test_the_runner_grades_this_library_at_the_vector_clock_and_now() -> None:
+    reports = [run_conformance(now=now) for now in (T0, None)]
+    for graded in reports:
+        assert graded.ok, graded.render()
+    report = reports[-1]
+    assert {c.suite for c in report.checks} == {"vectors", "live", "scenarios"}
+    doc = scenarios_document()
+    count = len(doc.request_scenarios) + len(doc.directory_scenarios) + len(doc.response_scenarios)
+    assert sum(c.suite == "scenarios" for c in report.checks) == count
+    (authority,) = [c for c in report.checks if c.id.startswith("R26 ")]
+    assert (authority.ok, authority.expected) == (True, "403 authority")
+
+
+def _vector_failures(adapter: Adapter) -> set[str]:
+    report = run_conformance(adapter, now=T0, suites=("vectors",))
+    return {c.id for c in report.failures}
+
+
+def test_an_adapter_that_accepts_everything_fails_every_refusal_and_the_wrong_identity() -> None:
+    def accepts_everything(op: Operation) -> Result:
+        return Verified(identity=BUYER, keyid="k")
+
+    # Every refusal fails, and so does the response vector, which names the seller.
+    assert _vector_failures(accepts_everything) == {*NEGATIVE, "positive/003-signed-response"}
+
+
+def test_an_adapter_that_crashes_fails_every_vector() -> None:
+    def crashes(op: Operation) -> Result:
+        return Refused.adapter_failure("adapter-crash", "exit 1")
+
+    assert _vector_failures(crashes) == set(ALL)
+
+
+def test_an_adapter_with_the_right_rule_and_the_wrong_status_fails() -> None:
+    def wrong_status(op: Operation) -> Result:
+        got = _library(op)
+        return (
+            replace(got, status=400 if got.status != 400 else 403)
+            if isinstance(got, Refused)
+            else got
+        )
+
+    assert _vector_failures(wrong_status) == set(NEGATIVE)
+
+
+def test_an_adapter_with_the_right_status_and_the_wrong_rule_fails() -> None:
+    def wrong_rule(op: Operation) -> Result:
+        got = _library(op)
+        return replace(got, rule="signature-invalid") if isinstance(got, Refused) else got
+
+    assert _vector_failures(wrong_rule) == set(NEGATIVE)
+
+
+# ── the command adapter contains every failure ────────────────────────────
+
+
+def _op() -> VerifyRequest:
+    op = vector_operation(POSITIVE["positive/001-single-signer-request"])
+    assert isinstance(op, VerifyRequest)
+    return op
+
+
+def _python(code: str) -> str:
+    return f'"{sys.executable}" -c "{code}"'
+
+
+def test_a_command_adapter_that_hangs_times_out() -> None:
+    got = CommandAdapter(_python("import time; time.sleep(5)"), timeout=0.5)(_op())
+    assert isinstance(got, Refused) and (got.status, got.rule) == (None, "adapter-timeout")
+
+
+def test_a_command_adapter_that_exits_reports_its_exit_code() -> None:
+    got = CommandAdapter(_python("import sys; sys.exit(3)"))(_op())
+    assert isinstance(got, Refused) and got.rule == "adapter-crash"
+    assert got.error.startswith("exit 3")
+
+
+def test_a_command_adapter_that_answers_garbage_is_invalid() -> None:
+    got = CommandAdapter(_python("print('not json')"))(_op())
+    assert isinstance(got, Refused) and (got.status, got.rule) == (None, "adapter-invalid")
+    status_zero = _python('print(\'{\\"ok\\": false, \\"status\\": 0, \\"rule\\": \\"x\\"}\')')
+    got = CommandAdapter(status_zero)(_op())
+    assert isinstance(got, Refused) and got.rule == "adapter-invalid"
+
+
+@pytest.mark.parametrize(
+    "answer",
+    [
+        {"ok": 1, "identity": BUYER, "keyid": "k"},
+        {"ok": True, "identity": BUYER, "keyid": "k", "body_covered": "on"},
+        {"ok": True, "identity": BUYER, "keyid": "k", "bound": "yes"},
+        {"ok": False, "status": 403.0, "rule": "signature-invalid"},
+    ],
+    ids=["ok-1", "body-covered-on", "bound-yes", "status-float"],
+)
+def test_an_answer_that_is_not_strict_json_is_adapter_invalid(
+    tmp_path: Path, answer: dict[str, object]
+) -> None:
+    # The protocol's booleans are JSON booleans and its statuses JSON integers.
+    script = tmp_path / "adapter.py"
+    script.write_text(f"print({json.dumps(json.dumps(answer))})")
+    got = CommandAdapter(f'"{sys.executable}" "{script}"')(_op())
+    assert isinstance(got, Refused) and (got.status, got.rule) == (None, "adapter-invalid")
+
+
+def test_a_command_adapter_that_cannot_start_crashes() -> None:
+    got = CommandAdapter("/nonexistent/adapter")(_op())
+    assert isinstance(got, Refused) and got.rule == "adapter-crash"
+
+
+# ── the command line ──────────────────────────────────────────────────────
+
+
+def _cli(*args: str, stdin: str = "") -> subprocess.CompletedProcess[str]:
+    return subprocess.run(
+        [sys.executable, "-m", "iab_agentic_primitives.web_bot_auth.conformance", *args],
+        input=stdin,
+        capture_output=True,
+        text=True,
+        check=False,
+    )
+
+
+def test_cli_adapter_runs_one_operation_and_line_mode_runs_many() -> None:
+    from iab_agentic_primitives.web_bot_auth.conformance.models import dump_json
+
+    op = dump_json(_op())
+    one = _cli("adapter", stdin=op)
+    assert json.loads(one.stdout)["identity"] == BUYER
+    many = _cli("adapter", "--lines", stdin=op + "\n" + json.dumps({"op": "nope"}) + "\n")
+    first, second = [json.loads(line) for line in many.stdout.splitlines()]
+    assert first["ok"] and (second["ok"], second["rule"]) == (False, "adapter-invalid")
+    assert "status" not in second
+
+
+def test_cli_check_and_run_through_a_command_adapter() -> None:
+    assert _cli("--check").returncode == 0
+    command = f'"{sys.executable}" -m iab_agentic_primitives.web_bot_auth.conformance adapter'
+    report = run_conformance(command, now=T0, suites=("vectors",))
+    assert report.ok, report.render()
+
+
+def test_a_signed_request_document_round_trips() -> None:
+    request = vector_request(POSITIVE["positive/001-single-signer-request"])
+    assert RequestDoc.of(request.message()) == request
diff --git a/tests/web_bot_auth/test_wba_wire.py b/tests/web_bot_auth/test_wba_wire.py
new file mode 100644
index 0000000..feb508b
--- /dev/null
+++ b/tests/web_bot_auth/test_wba_wire.py
@@ -0,0 +1,331 @@
+"""The wire format, through the public verifiers and signers.
+
+What the signature fields must look like, how a covered ``Content-Digest`` is
+checked, what the signers refuse, and which parameters the credential carries.
+Every case goes through :class:`RequestVerifier`, :class:`ResponseVerifier`,
+or a signer, so a restructure of the seams behind them doesn't touch it.
+"""
+
+from __future__ import annotations
+
+from collections.abc import Callable
+
+import pytest
+from http_message_signatures.exceptions import HTTPMessageSignaturesException
+
+from iab_agentic_primitives.web_bot_auth import (
+    HTTPRequest,
+    HTTPResponse,
+    Refusal,
+    RequestSigner,
+    ResponseSigner,
+    SigningError,
+    VerifiedRequest,
+)
+from iab_agentic_primitives.web_bot_auth.conformance.models import SignatureParameters
+from iab_agentic_primitives.web_bot_auth.conformance.signing import MessageDeparture
+from iab_agentic_primitives.web_bot_auth.rules import (
+    CONTENT_DIGEST,
+    REQUEST,
+    RESPONSE,
+    component_id,
+)
+from iab_agentic_primitives.web_bot_auth.signer import generate_nonce
+
+from .support import (
+    BUYER,
+    COMMIT_BODY,
+    COMMIT_URL,
+    JSON,
+    SELLER,
+    T0,
+    at,
+    buyer_key,
+    digest,
+    digest_without_sha256,
+    expect_refusal,
+    request_verifier,
+    response_verifier,
+    run,
+    seller_key,
+    sign_request,
+    sign_response,
+)
+
+AGENT = f'sig1="{BUYER}/.well-known/http-message-signatures-directory"'
+COVERED = '("@method" "signature-agent";key="sig1")'
+TAGGED = f'sig1={COVERED};created={T0};expires={at(300)};keyid="k";tag="web-bot-auth"'
+
+
+def _fields(**fields: str) -> HTTPRequest:
+    """A GET to the seller carrying these raw signature fields."""
+    names = {"input": "Signature-Input", "signature": "Signature", "agent": "Signature-Agent"}
+    return HTTPRequest("GET", COMMIT_URL, [(names[k], v) for k, v in fields.items()])
+
+
+def _verify(request: HTTPRequest, *, offset: int = 5) -> VerifiedRequest:
+    return run(request_verifier(now=at(offset)).verify(request))
+
+
+# ── the signature fields ──────────────────────────────────────────────────
+
+
+@pytest.mark.parametrize(
+    ("message", "refusal"),
+    [
+        (HTTPRequest("GET", COMMIT_URL, {"Signature-Agent": AGENT}), Refusal.SIGNATURE_MISSING),
+        (_fields(input="sig1=("), Refusal.PARSE),
+        (_fields(input='sig1=("@méthod")'), Refusal.PARSE),
+        (_fields(input='sig1=("@method");tag="a";tag="b"'), Refusal.PARSE),
+        (_fields(input='sig1="@method"'), Refusal.PARSE),
+        (_fields(input=TAGGED, signature="sig1=token"), Refusal.PARSE),
+        (_fields(input="sig1=(method)"), Refusal.PARSE),
+        (_fields(input='sig1=("@method";req=1)'), Refusal.PARSE),
+        (_fields(input='sig1=("@method";q=1;q=2)'), Refusal.PARSE),
+        (_fields(input='sig1=();created="1"'), Refusal.PARSE),
+        (_fields(input="sig1=();keyid=1"), Refusal.PARSE),
+        (_fields(input="sig1=();nonce=:AAAA:"), Refusal.PARSE),
+        (_fields(input=TAGGED, agent='sig1="a";x;x'), Refusal.PARSE),
+        (_fields(input=f"{TAGGED}, {TAGGED}"), Refusal.MULTIPLE_SIGNATURES),
+        (_fields(input=TAGGED, signature="sig1=:AA==:, sig1=:AA==:"), Refusal.MULTIPLE_SIGNATURES),
+        (
+            _fields(input=TAGGED, signature="sig1=:AA==:", agent=f"{AGENT}, {AGENT}"),
+            Refusal.MULTIPLE_SIGNATURE_AGENTS,
+        ),
+        # Step 1 runs whole before step 2: a malformed member is 400, whatever repeats.
+        (_fields(input=f"{TAGGED}, {TAGGED}, sig2=tok"), Refusal.PARSE),
+        # A Signature with no Signature-Input, such as another scheme's, is not parsed.
+        (
+            _fields(signature='keyId="k",algorithm="hs2019",headers="date",signature="abc"'),
+            Refusal.SIGNATURE_MISSING,
+        ),
+        (_fields(signature="sig1=:AAAA:"), Refusal.SIGNATURE_MISSING),
+        (_fields(input=f"sig1={COVERED}", signature="sig1=:AA==:"), Refusal.SIGNATURE_MISSING),
+        (
+            _fields(input=f"{TAGGED}, {TAGGED.replace('sig1=', 'sig2=')}", signature="sig1=:AA==:"),
+            Refusal.MULTIPLE_SIGNATURES,
+        ),
+        (_fields(input=TAGGED, signature="sig2=:AA==:"), Refusal.SIGNATURE_MISSING),
+    ],
+    ids=[
+        "unsigned",
+        "not-a-dictionary",
+        "not-ascii",
+        "repeated-parameter",
+        "member-not-an-inner-list",
+        "signature-not-a-byte-sequence",
+        "component-not-a-string",
+        "component-parameter-not-a-string-or-boolean",
+        "repeated-component-parameter",
+        "created-not-an-integer",
+        "keyid-not-a-string",
+        "nonce-not-a-string",
+        "signature-agent-repeated-parameter",
+        "repeated-member",
+        "repeated-signature",
+        "repeated-signature-agent",
+        "malformed-member-before-repeated-label",
+        "cavage-signature-alone",
+        "signature-alone",
+        "no-web-bot-auth-member",
+        "two-web-bot-auth-members",
+        "no-signature-member",
+    ],
+)
+def test_the_signature_fields_are_refused(message: HTTPRequest, refusal: Refusal) -> None:
+    expect_refusal(lambda: _verify(message), refusal)
+
+
+@pytest.mark.parametrize(
+    ("agent", "refusal"),
+    [
+        (f'{AGENT}, sig2="{BUYER}"', Refusal.MULTIPLE_SIGNATURE_AGENTS),
+        (f"{AGENT};type=directory", Refusal.SIGNATURE_AGENT_PARAMETERS),
+        (f'sig1="http://{BUYER[len("https://") :]}"', Refusal.SIGNATURE_AGENT_VALUE),
+        ("sig1=:AAAA:", Refusal.SIGNATURE_AGENT_VALUE),
+    ],
+    ids=["two-members", "parameters", "http", "not-a-string"],
+)
+def test_the_signature_agent_member_is_refused(agent: str, refusal: Refusal) -> None:
+    signed = sign_request(departure=MessageDeparture(signature_agent=agent))
+    expect_refusal(lambda: _verify(signed), refusal)
+
+
+@pytest.mark.parametrize("agent", [None, AGENT.replace("sig1=", "sig2=")], ids=["absent", "other"])
+def test_no_signature_agent_member_for_the_label_is_refused(agent: str | None) -> None:
+    fields = {"input": TAGGED, "signature": "sig1=:AA==:"} | ({"agent": agent} if agent else {})
+    expect_refusal(lambda: _verify(_fields(**fields)), Refusal.SIGNATURE_AGENT_MISSING)
+
+
+def test_an_uncovered_signature_agent_member_is_refused() -> None:
+    uncovered = REQUEST.components("sig1", has_body=True)[:-1]
+    signed = sign_request(departure=MessageDeparture(components=uncovered))
+    expect_refusal(lambda: _verify(signed), Refusal.SIGNATURE_AGENT_NOT_COVERED)
+
+
+def test_other_signature_agent_members_beside_the_label_are_ignored() -> None:
+    signed = sign_request(departure=MessageDeparture(signature_agent=f'{AGENT}, x="y";p'))
+    assert _verify(signed).origin.host == "buyer.example.com"
+
+
+def test_a_repeated_label_on_another_signers_member_leaves_the_signature_valid() -> None:
+    # Only the web-bot-auth member must be unique (OpenProposal § 2.8.2).
+    signed = sign_request()
+    other = 'other=("@method");tag="x"'
+    lines = signed.headers.with_replaced(
+        "Signature-Input", f"{signed.headers['Signature-Input']}, {other}, {other}"
+    ).with_replaced("Signature", f"{signed.headers['Signature']}, other=:AA==:, other=:AA==:")
+    assert _verify(HTTPRequest(signed.method, signed.url, lines, signed.body)).origin.host == (
+        "buyer.example.com"
+    )
+
+
+def test_a_binding_with_its_parameters_in_another_order_still_binds() -> None:
+    swapped = component_id("signature", {"key": "sig1", "req": True})
+    assert swapped == RESPONSE.binding("sig1")
+    assert str(swapped) != str(RESPONSE.binding("sig1"))
+    components = (*RESPONSE.components("sig1", has_body=True), swapped)
+    response = sign_response(sign_request(), departure=MessageDeparture(components=components))
+    assert run(response_verifier().verify(response)).bound is True
+
+
+# ── a covered Content-Digest ──────────────────────────────────────────────
+
+
+def _with_digest(value: str) -> HTTPRequest:
+    """The commit, signed, with ``value`` as its Content-Digest from the start when it
+    parses, and put in after signing when the library can't sign over it."""
+    try:
+        unchecked = MessageDeparture(content_digest=value)
+        return sign_request(HTTPRequest("POST", COMMIT_URL, JSON, COMMIT_BODY), departure=unchecked)
+    except SigningError:
+        signed = sign_request()
+        return HTTPRequest(
+            "POST", COMMIT_URL, signed.headers.with_replaced("Content-Digest", value), COMMIT_BODY
+        )
+
+
+def test_a_digest_with_sha_256_and_another_algorithm_verifies() -> None:
+    both = f"{digest_without_sha256(COMMIT_BODY)}, {digest(COMMIT_BODY)}"
+    assert _verify(_with_digest(both)).body_covered is True
+
+
+@pytest.mark.parametrize(
+    "value",
+    [
+        digest_without_sha256(COMMIT_BODY),
+        digest(b"y"),
+        f"{digest(COMMIT_BODY)}, {digest(COMMIT_BODY)}",
+        "sha-256=(",
+    ],
+    ids=["sha-512-only", "mismatch", "repeated-algorithm", "malformed"],
+)
+def test_a_bad_digest_is_refused(value: str) -> None:
+    expect_refusal(lambda: _verify(_with_digest(value)), Refusal.CONTENT_DIGEST)
+
+
+def test_a_bodyless_request_with_an_uncovered_digest_verifies_as_signed() -> None:
+    # The signer covers Content-Digest only with a body, so the verifier gives
+    # the library no body to check for a message whose signature doesn't cover it.
+    request = HTTPRequest("GET", COMMIT_URL, {"Content-Digest": digest(b"")})
+    verified = _verify(sign_request(request))
+    assert verified.body_covered is False
+    assert CONTENT_DIGEST not in verified.components
+
+
+# ── signing: every failure is a SigningError ──────────────────────────────
+
+
+def _buyer() -> RequestSigner:
+    return RequestSigner.of(buyer_key(), BUYER)
+
+
+SIGNED = {"Signature": "sig1=:AA==:", "Signature-Input": "sig1=()"}
+MISMATCHED = {"Content-Type": "text/plain", "Content-Digest": digest(b"y")}
+
+SIGNINGS: list[Callable[[], object]] = [
+    lambda: ResponseSigner.of(seller_key(), SELLER).sign(
+        HTTPResponse(200, {}, b"", HTTPRequest("GET", "/proposals/prop_7")), now=T0
+    ),
+    lambda: _buyer().sign(HTTPRequest("GET", "seller.example.com/x"), now=T0),
+    lambda: _buyer().sign(HTTPRequest("POST", COMMIT_URL, {}, b"x"), now=T0),
+    lambda: _buyer().sign(HTTPRequest("GET", COMMIT_URL, SIGNED), now=T0),
+    lambda: _buyer().sign(HTTPRequest("GET", COMMIT_URL), now=T0, nonce="short"),
+    lambda: _buyer().sign(HTTPRequest("POST", COMMIT_URL, MISMATCHED, b"x"), now=T0),
+]
+
+
+@pytest.mark.parametrize(
+    "sign",
+    SIGNINGS,
+    ids=[
+        "relative-response-request-url",
+        "relative-request-url",
+        "body-without-content-type",
+        "already-signed",
+        "invalid-nonce",
+        "mismatched-digest",
+    ],
+)
+def test_a_signer_raises_only_signing_error(sign: Callable[[], object]) -> None:
+    with pytest.raises(SigningError) as raised:
+        sign()
+    assert isinstance(raised.value, ValueError)
+    assert not isinstance(raised.value, HTTPMessageSignaturesException)
+
+
+def test_a_library_error_is_translated_with_its_cause() -> None:
+    # The library's URL grammar refuses a host with a space in it.
+    with pytest.raises(SigningError) as raised:
+        _buyer().sign(HTTPRequest("GET", "https://seller example.com/x"), now=T0)
+    assert isinstance(raised.value.__cause__, HTTPMessageSignaturesException)
+
+
+@pytest.mark.parametrize("url", ["/x", "seller.example.com/x", "ftp://seller.example.com/x"])
+def test_a_url_that_is_not_absolute_http_is_not_signed(url: str) -> None:
+    with pytest.raises(SigningError, match="not an absolute http or https URL"):
+        _buyer().sign(HTTPRequest("GET", url), now=T0)
+
+
+def test_a_claimed_alg_is_signed_as_claimed_and_refused() -> None:
+    signed = sign_request(departure=MessageDeparture(parameters=SignatureParameters(alg="x")))
+    assert ';alg="x";' in (signed.headers.get("signature-input") or "")
+    expect_refusal(lambda: _verify(signed), Refusal.ALG)
+
+
+# ── the credential comes from the signed parameters ───────────────────────
+
+
+def test_the_credential_carries_the_signed_parameters() -> None:
+    nonce = generate_nonce()
+    signed = _buyer().sign(HTTPRequest("POST", COMMIT_URL, JSON, COMMIT_BODY), now=T0, nonce=nonce)
+    verified = _verify(signed)
+    assert (verified.created, verified.expires, verified.nonce) == (T0, at(300), nonce)
+    assert verified.body_covered is True
+
+
+def test_a_second_unsigned_member_does_not_change_the_credential() -> None:
+    nonce = generate_nonce()
+    signed = _buyer().sign(HTTPRequest("GET", COMMIT_URL), now=T0, nonce=nonce)
+    other = f'cdn=("@method");created={at(-50)};expires={at(9)};nonce="other";tag="cdn"'
+    inputs = f"{signed.headers.get('signature-input')}, {other}"
+    signatures = f"{signed.headers.get('signature')}, cdn=:AAAA:"
+    lines = signed.headers.with_replaced("Signature-Input", inputs)
+    verified = _verify(HTTPRequest("GET", COMMIT_URL, lines.with_replaced("Signature", signatures)))
+    assert (verified.created, verified.expires, verified.nonce) == (T0, at(300), nonce)
+    assert verified.body_covered is False
+
+
+@pytest.mark.parametrize(
+    ("departure", "refusal"),
+    [
+        (MessageDeparture(parameters=SignatureParameters(expires=None)), Refusal.WINDOW),
+        (MessageDeparture(parameters=SignatureParameters(tag=None)), Refusal.SIGNATURE_MISSING),
+        (MessageDeparture(parameters=SignatureParameters(alg=None)), Refusal.ALG),
+    ],
+    ids=["no-expires", "no-tag", "no-alg"],
+)
+def test_a_signature_without_a_required_parameter_is_refused(
+    departure: MessageDeparture, refusal: Refusal
+) -> None:
+    expect_refusal(lambda: _verify(sign_request(departure=departure)), refusal)
diff --git a/uv.lock b/uv.lock
index 911ff63..374a528 100644
--- a/uv.lock
+++ b/uv.lock
@@ -1,6 +1,10 @@
 version = 1
 revision = 3
-requires-python = ">=3.11"
+requires-python = ">=3.12"
+resolution-markers = [
+    "python_full_version >= '3.15'",
+    "python_full_version < '3.15'",
+]
 
 [[package]]
 name = "annotated-doc"
@@ -33,6 +37,85 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/da/35/f2287558c17e29fafc8ef3daf819bb9834061cfa43bff8014f7df7f63bdc/anyio-4.14.2-py3-none-any.whl", hash = "sha256:9f505dda5ac9f0c8309b5e8bd445a8c2bf7246f3ce950121e45ea15bc41d1494", size = 125813, upload-time = "2026-07-12T20:29:05.763Z" },
 ]
 
+[[package]]
+name = "ast-grep-cli"
+version = "0.45.3"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/80/46/35e89cbf27fe8a866796f9cb6ae711b88e0ff67e14e2580ced649b3d6a19/ast_grep_cli-0.45.3.tar.gz", hash = "sha256:d8b527b71655eede16637311bc3ca49624b8198c48bffeb5dcf06a78332bf917", size = 283689, upload-time = "2026-08-31T02:27:07.267Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/58/8d/fded0d3cf2138b56454101e061ba8525bd47c9d022d924fd92320fad4d98/ast_grep_cli-0.45.3-py3-none-macosx_10_12_x86_64.macosx_11_0_arm64.macosx_10_12_universal2.whl", hash = "sha256:ebc1510a6775f65a8681345dd422590fb257fe48036a7c599a5ca9f54dea8801", size = 15743557, upload-time = "2026-08-31T01:50:19.053Z" },
+    { url = "https://files.pythonhosted.org/packages/30/f8/d9b41ae197bf9a41034a03d742d9bb2ca05bf4f7da741c00242019b44d3e/ast_grep_cli-0.45.3-py3-none-macosx_10_12_x86_64.whl", hash = "sha256:7afbe49870d8a34c0b224ac940da1fbf736617fcc81aa846884e377eddf8c1a0", size = 7870417, upload-time = "2026-08-31T01:50:21.881Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/d5/584cc4cf46a751f35fc086e9dca9962c05de2b37f95056f3653dc4736e19/ast_grep_cli-0.45.3-py3-none-manylinux_2_28_aarch64.whl", hash = "sha256:ced023ae9fbc7c779570cd8bcc0fa7626d9561afd60369d3c335bfce2ca565b3", size = 7752458, upload-time = "2026-08-31T01:50:23.52Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/20/1445bff6593d492c31904fe309c157cb16bcb73cfd30b4a55718acef5cb1/ast_grep_cli-0.45.3-py3-none-manylinux_2_28_x86_64.whl", hash = "sha256:2d151b89c6d45c2640338fe5d24b2ee0810224902d603cb271803bf7418054ea", size = 8027608, upload-time = "2026-08-31T01:50:25.179Z" },
+    { url = "https://files.pythonhosted.org/packages/2e/da/03562d9c4994d756d7fa7b751f7e92f4218d96fd86bdd27a5fe7be63e4d8/ast_grep_cli-0.45.3-py3-none-win32.whl", hash = "sha256:b96c897dc44052c7b1d08ba6086d0c270fe89d37645e38f08e2d4fa15948ea3c", size = 14970295, upload-time = "2026-08-31T01:50:27.325Z" },
+    { url = "https://files.pythonhosted.org/packages/b2/cc/a8d5a4039470b58a4b0a5ce9826975796ff091539849984f04a0ac98582f/ast_grep_cli-0.45.3-py3-none-win_amd64.whl", hash = "sha256:13dfb43b2028bb585f41b2f399e8b30bf0310e9bbeff2369d60a2e36accbb2e6", size = 15914271, upload-time = "2026-08-31T01:50:30.211Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/8e/bb893d035ee6349a07287f83b471fc54b067c2c61b34dd6c9e2072a7064f/ast_grep_cli-0.45.3-py3-none-win_arm64.whl", hash = "sha256:6c4222e17ac7a9e23c839b6eefb3a7858349e7a37a704acd451c266beadf75b4", size = 15293472, upload-time = "2026-08-31T02:27:05.122Z" },
+]
+
+[[package]]
+name = "ast-serialize"
+version = "0.13.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/21/d5/5dc1ee8a80c3b20a0b63c61b43ba6bc53517faecd1def47bcd752d22268e/ast_serialize-0.13.1.tar.gz", hash = "sha256:401cc84e8888d4d76f2c8d296fa006ed1a5ff993b6aff90dd777c03973efd025", size = 955137, upload-time = "2026-10-17T00:04:17.183Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/f3/a8/fbd136b9f70c59e75f59a8e974c84102976f1201828b4f886480ba956936/ast_serialize-0.13.1-cp314-cp314-pyemscripten_2026_0_wasm32.whl", hash = "sha256:3e129d44b0cffbea24a7f40117ce49e30993c3d119e584d4817ebd6f87246456", size = 897306, upload-time = "2026-10-17T00:02:52.479Z" },
+    { url = "https://files.pythonhosted.org/packages/50/3f/2ad51e9823a790e7a70fd781e9595ab3abeace27f3aefcaa1939457efd72/ast_serialize-0.13.1-cp314-cp314t-macosx_10_12_x86_64.whl", hash = "sha256:523d45bab16ddaf1399c04c4fe81bbf180f81e33c2f7bcbe76be56b0f7311ab4", size = 1236082, upload-time = "2026-10-17T00:02:54.82Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/5c/8e959db5cc2237f9d4c560a8e2253c98f9746883fb4774651e4cda458901/ast_serialize-0.13.1-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:638333fb8ae72c62753f9e794fda20290883ddc65b0d85e26e08f8bb227567ad", size = 1221242, upload-time = "2026-10-17T00:02:56.395Z" },
+    { url = "https://files.pythonhosted.org/packages/d6/05/ab1c56c3b7adcac88764bba609502d6b4989e449b2dd60eb478e1d20e369/ast_serialize-0.13.1-cp314-cp314t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:cc34c670747d85d4232834665e247009413eaebe47c69eaf60a5c439aaecaed9", size = 1282105, upload-time = "2026-10-17T00:02:58.275Z" },
+    { url = "https://files.pythonhosted.org/packages/0d/f4/41981fcd2ddffe0760e5326be9dcbd2eda9478a8430a637e5123bd8fcb26/ast_serialize-0.13.1-cp314-cp314t-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:8c8ebd419811c435812d242fb2a173e57dfede198c9ac9a0a584666ebc9b9331", size = 1287905, upload-time = "2026-10-17T00:03:00.068Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/43/b783addc5681153707121991b7b47892f7e9c8ba58a0d03b71a3b023ba47/ast_serialize-0.13.1-cp314-cp314t-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:8899c038b1c15ae8b98e379057fb3ef398ceb0b21d1737a8156dd5a0923b7e51", size = 1541806, upload-time = "2026-10-17T00:03:01.503Z" },
+    { url = "https://files.pythonhosted.org/packages/47/10/969db095038ee15270f65ad20d1129c5e4da605bf7e93b70ae640f1c8a9f/ast_serialize-0.13.1-cp314-cp314t-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:e14c4de98f965647a74e6eaf37e20207124e45451ccd36e84a6f6ebab45e0372", size = 1309946, upload-time = "2026-10-17T00:03:02.971Z" },
+    { url = "https://files.pythonhosted.org/packages/06/dd/7c623d2fb0b868948952d1787e629a43b866f7d4caefd5445e20aefacec4/ast_serialize-0.13.1-cp314-cp314t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:7f3e8a3eff69af640db985360fef35073fb46956dfc3e5c614cf00920d2746dd", size = 1302773, upload-time = "2026-10-17T00:03:04.378Z" },
+    { url = "https://files.pythonhosted.org/packages/d4/c2/4d49469110a19a44fc6269f4fd59679bcf84df068f185f89b73bee4da19b/ast_serialize-0.13.1-cp314-cp314t-manylinux_2_31_riscv64.whl", hash = "sha256:75d7750fe98f6f35a96c43aba8d98a2e623e22c778a0c17ab9ede92eb10f5d82", size = 1299579, upload-time = "2026-10-17T00:03:05.88Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/9a/2d381f1f262dda15affc8ad643fba1619eb07e7d9f8bd904deffef183006/ast_serialize-0.13.1-cp314-cp314t-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:43e8ddd63e80fc280c2f790157386f27f9b9f6ccb9c4f8e803b863cbfb085769", size = 1355969, upload-time = "2026-10-17T00:03:07.321Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/9c/2266794e6c25fa9ce51ce04a9bf4b7e330e3ac9351ba3fa14e487678acdb/ast_serialize-0.13.1-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:9221e09496fb942901993c1812ee87950cc0ecbb514c7c0f1f5fa6d78f701ed8", size = 1460227, upload-time = "2026-10-17T00:03:08.733Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/d6/14deb28e5d8f328f626a0778ea2cf98fe908f2bbcccd804cb6f449ee1782/ast_serialize-0.13.1-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:7a5c38bdb93669c596f94fb7204dd6ebe4fadb19058ac9a2faf2948c2a175f96", size = 1562691, upload-time = "2026-10-17T00:03:10.25Z" },
+    { url = "https://files.pythonhosted.org/packages/f5/19/7a28c0e5ba54f0d3e054f847a2a549b748cb179ab433321a8dc1b39e398d/ast_serialize-0.13.1-cp314-cp314t-musllinux_1_2_i686.whl", hash = "sha256:acf4e9f055d75058ab01536da330648746f2f82b7697a85230547f2d5ebe895c", size = 1558669, upload-time = "2026-10-17T00:03:11.799Z" },
+    { url = "https://files.pythonhosted.org/packages/18/9a/f9e2690eab58217f1d395a964a78efa7eaf813a1e38be8dfd9a8d45d0840/ast_serialize-0.13.1-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:87427913c325adc811e81e7c9a757b061f47ef1e29114ac479aa0953a2687a98", size = 1665071, upload-time = "2026-10-17T00:03:13.284Z" },
+    { url = "https://files.pythonhosted.org/packages/8e/f3/ef5b159a0d7161b404f05e7ec21cf7735ee7edc10c000cd2cbbc7bb6b69a/ast_serialize-0.13.1-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:ad88921f95b92bc144d9ad059a0e16f8c1ae69f5239f2d3c6536fd2774f73dfe", size = 1473364, upload-time = "2026-10-17T00:03:14.563Z" },
+    { url = "https://files.pythonhosted.org/packages/1d/87/6e8ac4a865124a12cc4f915bf1bcfac3bba426cd5f58d3712a873ee61012/ast_serialize-0.13.1-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:f8b17e2921e56621bcb46792bd3e0b82ca3b85de78d5936e7b8174ba1758b0aa", size = 1500566, upload-time = "2026-10-17T00:03:15.917Z" },
+    { url = "https://files.pythonhosted.org/packages/f5/1e/29155f1621433008013ad5c940a03d41a676be0680c41527040472d37583/ast_serialize-0.13.1-cp314-cp314t-win32.whl", hash = "sha256:2f9a9ce8b0994f757b941f7f7fe384a6666b4162b941ebc5c248081baea18e47", size = 1128674, upload-time = "2026-10-17T00:03:17.481Z" },
+    { url = "https://files.pythonhosted.org/packages/bb/64/2506da65143ea138de5822e9173e0b72320a2f70e23bd723f044033175f1/ast_serialize-0.13.1-cp314-cp314t-win_amd64.whl", hash = "sha256:5d99910e6b9a9b9360bcca2ae99aee36cc912ce058df2a57d1c33099b6cb2593", size = 1163306, upload-time = "2026-10-17T00:03:19.046Z" },
+    { url = "https://files.pythonhosted.org/packages/6d/8f/c7cb22638899b0cf15908809c270560e46395e65604bc59e4b623ab9f405/ast_serialize-0.13.1-cp314-cp314t-win_arm64.whl", hash = "sha256:a789cbe14d0a0e9ec9b32a456e5abc81ad8799479c3cfd88a29e3442262aebe6", size = 1133775, upload-time = "2026-10-17T00:03:20.377Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/e2/b0c140fe50fa39dd249e382f7733af6f816c90021fe7959a0b026f86237f/ast_serialize-0.13.1-cp315-abi3.abi3t-macosx_10_12_x86_64.whl", hash = "sha256:23d768369b89d551077dc173da6892fad00443338417523b6732f4e8ba4a7ed5", size = 1236160, upload-time = "2026-10-17T00:03:21.945Z" },
+    { url = "https://files.pythonhosted.org/packages/23/c4/a8a2ca21e3943555b48221f8fba546877a7ad39efaf6505506524967d7c4/ast_serialize-0.13.1-cp315-abi3.abi3t-macosx_11_0_arm64.whl", hash = "sha256:68f8829d114dab6c9db4a8bbb8d0e342958faee1b5e15a29022678df639960f8", size = 1222214, upload-time = "2026-10-17T00:03:23.462Z" },
+    { url = "https://files.pythonhosted.org/packages/15/19/2f58f2ba64e4799b39de85c140aef09a03aa6ea53be75dd292a9d9b9d8ae/ast_serialize-0.13.1-cp315-abi3.abi3t-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:4e385b17d5bde892a6184003a9aff3518387908b73f8f5ea539313c07c8c0ede", size = 1282979, upload-time = "2026-10-17T00:03:24.695Z" },
+    { url = "https://files.pythonhosted.org/packages/b1/af/ca6087fe84210c1ccd43e3182917bb70649fa1e69745a90c1d59ba08fea8/ast_serialize-0.13.1-cp315-abi3.abi3t-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:02686b281ec9b8e9614f6f0db27e12e4cac515f336c5d05b678bc9eb73ff2af5", size = 1288596, upload-time = "2026-10-17T00:03:26.04Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/2c/4ef964c763329a0347125e745ec0451ba4fbaceec9efe2ac729b7cd55f17/ast_serialize-0.13.1-cp315-abi3.abi3t-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:a8ab2c2585b2e22e48cd4aff2136fce4eab4ced569b85f150ef9a5a5d6f34d49", size = 1545540, upload-time = "2026-10-17T00:03:27.52Z" },
+    { url = "https://files.pythonhosted.org/packages/bb/85/aa961dbb75813cfa94de0ce9a16a9510c226b95f604c405421e727f44bb0/ast_serialize-0.13.1-cp315-abi3.abi3t-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:c652d9f5d52d8b81eff3ff2c95c9dd0f281de45f6ad5d3fa95527550c396454a", size = 1309374, upload-time = "2026-10-17T00:03:29.091Z" },
+    { url = "https://files.pythonhosted.org/packages/b4/e6/f2b67c327d9f9533e41791804403ccc2dc457821195a2e51f0b587a90b90/ast_serialize-0.13.1-cp315-abi3.abi3t-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:121e1d08d58b75c15491cc3003609cbad71ac2b0016043c36d30a6b2032b6605", size = 1303466, upload-time = "2026-10-17T00:03:30.451Z" },
+    { url = "https://files.pythonhosted.org/packages/73/1d/33f18b81d1bb1f5d682943ea92fda8130a6593627f12f6201668d40824fd/ast_serialize-0.13.1-cp315-abi3.abi3t-manylinux_2_31_riscv64.whl", hash = "sha256:30cf89b6a6844542d116c758725d13de5b97b9410a51ee577715f761270d0c1c", size = 1300576, upload-time = "2026-10-17T00:03:32.102Z" },
+    { url = "https://files.pythonhosted.org/packages/25/cb/64914144925f1a4abdd9217e717b122255c38fc5ebe4342f92052f3bacbc/ast_serialize-0.13.1-cp315-abi3.abi3t-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:732aaae9e498c973fc63fd7f308009b57c4afa6ff59d0b674d894e57d0bca01a", size = 1355960, upload-time = "2026-10-17T00:03:33.676Z" },
+    { url = "https://files.pythonhosted.org/packages/ee/80/bd29379fab2bce19adc0bf9177002b11b23dfe8d8fecf409998b458b4624/ast_serialize-0.13.1-cp315-abi3.abi3t-musllinux_1_2_aarch64.whl", hash = "sha256:d9c1a920b2aa0c1e016bed7721689717034ca0dba64ac3a3ff243b003d4e8dd8", size = 1459779, upload-time = "2026-10-17T00:03:35.09Z" },
+    { url = "https://files.pythonhosted.org/packages/83/89/012dbe733de05ffdf8e40ca0f9fa5d417cb16ec93a74463c57c001914198/ast_serialize-0.13.1-cp315-abi3.abi3t-musllinux_1_2_armv7l.whl", hash = "sha256:847cad4c22953823f5e76d0b126c6f9da670cfa45b1df41b9324e22189d77611", size = 1563399, upload-time = "2026-10-17T00:03:37.285Z" },
+    { url = "https://files.pythonhosted.org/packages/69/37/ee4bcb0358bee38744eb0f18560446572d095fe3bf6b63d6f739d08a839c/ast_serialize-0.13.1-cp315-abi3.abi3t-musllinux_1_2_i686.whl", hash = "sha256:aca07de3ca8e3d9f2b716c3c31f4f384fe4bd2d03e09912417cff7a3e08036f7", size = 1558808, upload-time = "2026-10-17T00:03:38.711Z" },
+    { url = "https://files.pythonhosted.org/packages/54/1c/ff44c5355251d61ef22934c4430bb31a61de4781d25a992154aac9b8c82a/ast_serialize-0.13.1-cp315-abi3.abi3t-musllinux_1_2_ppc64le.whl", hash = "sha256:5db12d843d931b9d1f1519ce66b9cbfe72d8563b75c1204d255322254d1964dd", size = 1666324, upload-time = "2026-10-17T00:03:40.376Z" },
+    { url = "https://files.pythonhosted.org/packages/c8/bb/6da4bfc8aa3403e6447607131bf3463acaf954d990c6c8b6787c1902ddfe/ast_serialize-0.13.1-cp315-abi3.abi3t-musllinux_1_2_riscv64.whl", hash = "sha256:fb8021f4dc3296de18737e3b8b34994411da725374d74a0b9eb32a738f2a23d0", size = 1474089, upload-time = "2026-10-17T00:03:41.715Z" },
+    { url = "https://files.pythonhosted.org/packages/21/97/897e33bef2eefd880e6350e375cc66bc5bcd00a139be480fd655f5b3f095/ast_serialize-0.13.1-cp315-abi3.abi3t-musllinux_1_2_x86_64.whl", hash = "sha256:0d764913374ba21df8cd618045b371ed104ce55c6276de7c59e554a4f5ba26fd", size = 1501542, upload-time = "2026-10-17T00:03:43.08Z" },
+    { url = "https://files.pythonhosted.org/packages/8d/4c/821211ac83870c27e4412381b7c7838336456b40575bf840e4680b2018d9/ast_serialize-0.13.1-cp315-abi3.abi3t-win32.whl", hash = "sha256:2bad302ae2427454ef9dab71bd5c3ad67188860c39d36daee38f72031edb39c4", size = 1126118, upload-time = "2026-10-17T00:03:44.616Z" },
+    { url = "https://files.pythonhosted.org/packages/1f/86/2b2d5e6c4fa352874a80618e742ffd32d249dee6c119f4233b51afc6b8f4/ast_serialize-0.13.1-cp315-abi3.abi3t-win_amd64.whl", hash = "sha256:032b09d86c785c3984e975378b7861f2a68ac44e22ba7b07b93a536b2524eeb8", size = 1163766, upload-time = "2026-10-17T00:03:45.986Z" },
+    { url = "https://files.pythonhosted.org/packages/77/a3/d610cfcdabaa44fd62a54ca1fc57a7dba120643798b089a14914973562de/ast_serialize-0.13.1-cp315-abi3.abi3t-win_arm64.whl", hash = "sha256:929eda0c419e622ab49df3a4c45f81c57dcc10874bbad55d0470a4a03324dac3", size = 1134043, upload-time = "2026-10-17T00:03:48.453Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/89/0e30f9eddf7d44ccf9d25979030754fd0457af61fa4279acb8c293a04f97/ast_serialize-0.13.1-cp315-cp315-pyemscripten_2026_5_wasm32.whl", hash = "sha256:bf53a3ba1cbe45399fc1e4ccd684b8f2a11cca450f89706b79122f478534c6f5", size = 897546, upload-time = "2026-10-17T00:03:50.093Z" },
+    { url = "https://files.pythonhosted.org/packages/81/92/d705be88ff452b9ba0088b554a0cbd308fd01879da092b33fd2ad7d1aa60/ast_serialize-0.13.1-cp39-abi3-macosx_10_12_x86_64.whl", hash = "sha256:4bcf1d5f4eefecaa325a34ecf079b2741189e7d0821523f92cb343a389a67489", size = 1242416, upload-time = "2026-10-17T00:03:51.521Z" },
+    { url = "https://files.pythonhosted.org/packages/60/c2/98370845a7f35cb8a25782e78284b48e01bf3128339881d48d613f304f8f/ast_serialize-0.13.1-cp39-abi3-macosx_11_0_arm64.whl", hash = "sha256:1b158f1c9e3a0d386913924c57995d6df78224868a4d0f215bdd41587c97b34a", size = 1229729, upload-time = "2026-10-17T00:03:52.825Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/8b/2d7ffed76addd9d3fcf37fb171400942735c8912264c763561a85407f6a8/ast_serialize-0.13.1-cp39-abi3-manylinux_2_17_aarch64.manylinux2014_aarch64.whl", hash = "sha256:77a6201b69ce42e919f2fd9a559138d5410b5d8afff7c3a6b1f500b0481ff7d8", size = 1292255, upload-time = "2026-10-17T00:03:54.148Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/2a/bb9e0e719d89cc950fadfcfcc9cb4bc7640419c4228c852f031ab8abf440/ast_serialize-0.13.1-cp39-abi3-manylinux_2_17_armv7l.manylinux2014_armv7l.whl", hash = "sha256:6eb0be64c9b8f1ed26637eef345abe75ea90351c92c85a8aec7838b3af971011", size = 1298501, upload-time = "2026-10-17T00:03:55.559Z" },
+    { url = "https://files.pythonhosted.org/packages/7a/32/13ce07dce48226f5bd9cfd8f708ec101a8be05aa430cda4918ce31ce8c82/ast_serialize-0.13.1-cp39-abi3-manylinux_2_17_ppc64le.manylinux2014_ppc64le.whl", hash = "sha256:7f2427bddfca208e84de700044fadf9aef2769a70bae740a1bdabb89ee9e1117", size = 1553758, upload-time = "2026-10-17T00:03:56.952Z" },
+    { url = "https://files.pythonhosted.org/packages/e2/fb/9b51d186db0c20ca28cbaaefd50f03b573c89327b9a2627820cbce22196b/ast_serialize-0.13.1-cp39-abi3-manylinux_2_17_s390x.manylinux2014_s390x.whl", hash = "sha256:88df960e67184a71874e5b2ee014f87d1254a0dbc1f903c7bd7b1ab7733ecaef", size = 1318258, upload-time = "2026-10-17T00:03:58.418Z" },
+    { url = "https://files.pythonhosted.org/packages/c5/fa/da311559dd3dae9af5825cf21660775a929b970f72e3786af3f2cd667944/ast_serialize-0.13.1-cp39-abi3-manylinux_2_17_x86_64.manylinux2014_x86_64.whl", hash = "sha256:9f99786e0d62082a5b121b3437f3167562133711df22128de1e9886f57f0b226", size = 1313260, upload-time = "2026-10-17T00:04:00.194Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/11/97a4b9e5b4776d72f47fcd9a09a497bbf68ec8c1ae074307a2c51e410d85/ast_serialize-0.13.1-cp39-abi3-manylinux_2_31_riscv64.whl", hash = "sha256:a01b515b25a03184eff4acef25b981ae007916379682e908fc8785b342a0bf3e", size = 1309992, upload-time = "2026-10-17T00:04:01.575Z" },
+    { url = "https://files.pythonhosted.org/packages/2e/c4/62f85121a80cd451ef04f550cf0f7ea0ad9ff46cc4e9a5b9ae439b6527b1/ast_serialize-0.13.1-cp39-abi3-manylinux_2_5_i686.manylinux1_i686.whl", hash = "sha256:29422d7bcd9e7f39411571c36cec45ce8a7a9b3ad4b2e7aa64497c15a9e397f6", size = 1362715, upload-time = "2026-10-17T00:04:02.881Z" },
+    { url = "https://files.pythonhosted.org/packages/c1/fa/c5f4a545f72a7681e3295bab6e3600ee0862ec4391bed961fe9f735b67e0/ast_serialize-0.13.1-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:6ffb0f548a7dc126067fdfb7b2325ab5dfcdeecc29faf5e0f0461c96d6ebfa3d", size = 1469931, upload-time = "2026-10-17T00:04:04.181Z" },
+    { url = "https://files.pythonhosted.org/packages/38/a9/65aed4f8fa7a001a7cfdc03e68e844517ab041ba6fb614b7d78a1d6ac056/ast_serialize-0.13.1-cp39-abi3-musllinux_1_2_armv7l.whl", hash = "sha256:2876444a5f87a7c76f371af3c07c2fda563a08bc8af52568df812e8aba4bf568", size = 1570945, upload-time = "2026-10-17T00:04:05.778Z" },
+    { url = "https://files.pythonhosted.org/packages/fb/8c/44b2da991cede79bfbf52089f33a5f0168945466b3d9cd38b5dcf08e7130/ast_serialize-0.13.1-cp39-abi3-musllinux_1_2_i686.whl", hash = "sha256:885a62ec6481ce58ab24c6357360d7a82023b62dd7e5e7ceccf59e9662a3272b", size = 1569978, upload-time = "2026-10-17T00:04:07.347Z" },
+    { url = "https://files.pythonhosted.org/packages/46/e4/109b2a5beca700237767d5add920c2f8e1ba9bd5799b0faf143d0e9cf4ef/ast_serialize-0.13.1-cp39-abi3-musllinux_1_2_ppc64le.whl", hash = "sha256:2015fd0165e463aac3b1aadc6a1fa1e5820c14ca950821f4fe02f8a3f6a388d6", size = 1676082, upload-time = "2026-10-17T00:04:08.7Z" },
+    { url = "https://files.pythonhosted.org/packages/73/e0/7df70f6dbb11b5762da5416318f08316a1c51348e0d69ec79ca5f98f836a/ast_serialize-0.13.1-cp39-abi3-musllinux_1_2_riscv64.whl", hash = "sha256:eb41e1906502ac80d24ff343f45008552a3f5b5158607959fe6a07dbfc6eb037", size = 1483207, upload-time = "2026-10-17T00:04:10.162Z" },
+    { url = "https://files.pythonhosted.org/packages/1f/bc/523aa1c08bd69b5654621beb3dc1a9035715a4a63762fb8d219d6fb3eb81/ast_serialize-0.13.1-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:ca9acc67f796aa2554fa3037dccc022a4b08b38b2ad153edfac9c9bb7cb1f3c6", size = 1512140, upload-time = "2026-10-17T00:04:11.589Z" },
+    { url = "https://files.pythonhosted.org/packages/66/83/6607060659998f00afdea0d8375c1e6e2b7d515ab905090d9a5a02f48851/ast_serialize-0.13.1-cp39-abi3-win32.whl", hash = "sha256:4f98da562e5901d69c7dd30885594c5438f859edf354e9ac7517d188fb026c3a", size = 1131889, upload-time = "2026-10-17T00:04:12.953Z" },
+    { url = "https://files.pythonhosted.org/packages/9f/6f/bafd6490fe7b355627fabe95f4417e3d02da93102c8552550eb9a0774e1e/ast_serialize-0.13.1-cp39-abi3-win_amd64.whl", hash = "sha256:ddf7cbc9c8abf70102c4a088efe154bb86bfb825b0a10e556d2b15972cf99bd7", size = 1171153, upload-time = "2026-10-17T00:04:14.362Z" },
+    { url = "https://files.pythonhosted.org/packages/11/25/4235f4b375a67a37ac595bf478a5407a744eaf7b64113c1c3a5432b8d954/ast_serialize-0.13.1-cp39-abi3-win_arm64.whl", hash = "sha256:48f11d96c9ec71119612f8e79a8c55c12f2b136716d68347433c561d27a25f43", size = 1139035, upload-time = "2026-10-17T00:04:15.767Z" },
+]
+
 [[package]]
 name = "certifi"
 version = "2026.6.17"
@@ -42,6 +125,104 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/ef/2f/c5464532e965badff2f4c4c1a3a83f5697f0d7c407ed0cda44aaa99bb451/certifi-2026.6.17-py3-none-any.whl", hash = "sha256:2227dcbaafe0d2f59279d1762ddddc37783ed4354594f194ffc31d20f41fc3db", size = 133289, upload-time = "2026-06-17T10:31:06.348Z" },
 ]
 
+[[package]]
+name = "cffi"
+version = "2.1.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "pycparser", marker = "implementation_name != 'PyPy'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/9e/ef/008a1939e372c06329a3fce4279c02f328488f3526744906eeec3da7ad5f/cffi-2.1.1.tar.gz", hash = "sha256:dd31f52ea1086513bb9df30f8fcee9b8918323ae067a3d5b78bc826a000712be", size = 530807, upload-time = "2026-08-03T21:21:18.939Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/70/d2/16d99a0c4948febc0ebd133a13b2f688ff7f8cb04da971e1128872ce0c03/cffi-2.1.1-cp311-cp311-macosx_10_15_x86_64.whl", hash = "sha256:c8d2c9fd1f2d16f780d15127abb050d13d1a76c03a4bd87d7e4980e45e511e12", size = 183838, upload-time = "2026-08-03T21:19:29.637Z" },
+    { url = "https://files.pythonhosted.org/packages/cd/95/31b535a9f0220ae9f357de4a08d57ce89cb417653c2fd9f075f50822a388/cffi-2.1.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:398aff33cee2767e3e781d2554c54bd0dff386bb437581e0d8011fde1a942ec1", size = 184168, upload-time = "2026-08-03T21:19:30.764Z" },
+    { url = "https://files.pythonhosted.org/packages/ad/5a/4707a0dc1f203f5dde5a907b0d4e3c25d71120241048bd5bc6f1bb9d4e71/cffi-2.1.1-cp311-cp311-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:154852545011f779917b11c78db2358d095da62a9a172b78ad0a583ee5adc0d0", size = 211805, upload-time = "2026-08-03T21:19:31.867Z" },
+    { url = "https://files.pythonhosted.org/packages/ad/66/c19feabb28485b6e0bbaaafa90837a1ef5d302e90f2178bd33f17a49879b/cffi-2.1.1-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:3311ed60d36f83378794e1009ac6258bafbf81f7888b4caa7b35a521e3f95813", size = 218716, upload-time = "2026-08-03T21:19:32.896Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/92/500760486c8baab49a7a8a58ba7fc3355ec3974b454b8a09e528efde9e1d/cffi-2.1.1-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:6e192623c49c94421616a5778fba35cf0d5a8d000650c1967ef4448ee5cdd990", size = 205569, upload-time = "2026-08-03T21:19:34.142Z" },
+    { url = "https://files.pythonhosted.org/packages/a5/a7/a67c733254d6e7373f7822f8082d8d6beade791e0cf12a7611f376fa61c7/cffi-2.1.1-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:a6e721d4b0e45d5b65e87534470e67b18dcd092c83f68fba09f152b9cbc061af", size = 204907, upload-time = "2026-08-03T21:19:35.174Z" },
+    { url = "https://files.pythonhosted.org/packages/f7/a4/4399daaf8f7dfee9d7c3327fdb0426ee041cc63edc358b93911ceb2bfc7a/cffi-2.1.1-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:34e261f78cb6ceaaa36f42f2613f4380d94d9c759a9c73c769ee6e0247364632", size = 217807, upload-time = "2026-08-03T21:19:36.286Z" },
+    { url = "https://files.pythonhosted.org/packages/28/f7/dabe6da2466ecbd82dc62e7342dc6b1065dad990c06f00f0ede9ebf2a0ed/cffi-2.1.1-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:7225e4514edb64eb6740324353e0da0711954fd8d7da4576755b1c6e09b697cd", size = 221252, upload-time = "2026-08-03T21:19:37.416Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/87/616202d8e51342c07d2534c510111c4cc37201775ce8f60802c9335d1edd/cffi-2.1.1-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:df913725b79db7bcf03448f36b7bf8815363417d5b58deecf9305e3e30f0f21a", size = 214214, upload-time = "2026-08-03T21:19:38.507Z" },
+    { url = "https://files.pythonhosted.org/packages/b4/c6/ab025d75d2c26c19b087c0124e75ee31cb65032f4fe345d356d8c507ab97/cffi-2.1.1-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:f5cfbc5fe74540d335175b656c725d74d90e3730c626d92575eea35029d9afaa", size = 219408, upload-time = "2026-08-03T21:19:39.809Z" },
+    { url = "https://files.pythonhosted.org/packages/db/e2/7e8109f65445bdc673a7b54f02c677de462db75674220fd1335efc8eb598/cffi-2.1.1-cp311-cp311-win32.whl", hash = "sha256:f8ec5e643a9a937f64e1999eb9f75d072263751912dc5cd06d3c85f8f44be7c3", size = 174470, upload-time = "2026-08-03T21:19:41.246Z" },
+    { url = "https://files.pythonhosted.org/packages/73/c0/77ba02423c2f7d7091143c45cd49e0e6575c4c1967394bb542bd923a9b74/cffi-2.1.1-cp311-cp311-win_amd64.whl", hash = "sha256:42f6930c31dc7f50732c9ae793c2786c7b6b044195967bbdde40bb9be81c4cc0", size = 185096, upload-time = "2026-08-03T21:19:42.615Z" },
+    { url = "https://files.pythonhosted.org/packages/7c/47/9f1f85f9672ceda4984dc6c4f8824e8558992a2972c3d3c81fb8eb28d4ba/cffi-2.1.1-cp311-cp311-win_arm64.whl", hash = "sha256:c7659f22557c5a0bc4855cd635f55edec690cc008a40768527762cb9fb263455", size = 179941, upload-time = "2026-08-03T21:19:43.747Z" },
+    { url = "https://files.pythonhosted.org/packages/10/69/43965eccfdead3b9220015fd1320e117be8c6ed01a62ffab76eeb752f5d5/cffi-2.1.1-cp312-cp312-macosx_10_15_x86_64.whl", hash = "sha256:c8c69575568085ba0b1b10c0249d779a214aea6f6522e949a0fc9fb0fcb449d0", size = 184821, upload-time = "2026-08-03T21:19:44.887Z" },
+    { url = "https://files.pythonhosted.org/packages/54/7d/16e5a096677b5e313ca80cd5e5170efa3ea44624a82bb111925522da64b1/cffi-2.1.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:f81b3b8f3d4e343550fa4baa0e479bba9f2d29ce9c2e9b51d1ce1718d7442fcf", size = 184719, upload-time = "2026-08-03T21:19:46.129Z" },
+    { url = "https://files.pythonhosted.org/packages/56/e6/8941622732edec876dd17d0453dce07317ae96db34f2ec1436c9d3785986/cffi-2.1.1-cp312-cp312-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:811bd1e21d32de12efca32393a0ab3f5133b54fce9bd44b8bd77ab07da14bf6a", size = 214799, upload-time = "2026-08-03T21:19:47.218Z" },
+    { url = "https://files.pythonhosted.org/packages/44/de/f98430906df1545ffde0d543dd124a7a439bc2cd32b36b9c53f805df7333/cffi-2.1.1-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:68e62fe11f30d5ca8289242866f0a5291402d8529ca2178ab8afc5c9694ae890", size = 222389, upload-time = "2026-08-03T21:19:48.331Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/5b/717f1526b9957b34456313c31645c5b82b8fb5c3fe9e4752999be7128bfc/cffi-2.1.1-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:4a7c934f7360e8cd64fe9efadcbd10c7c6364f531e432b9a4bf5ccbc9e0e8b50", size = 210249, upload-time = "2026-08-03T21:19:49.543Z" },
+    { url = "https://files.pythonhosted.org/packages/64/b3/f8aa4f3e34986c7e4ec45072d1b1b9dd295b6b18007b45518d79726dd725/cffi-2.1.1-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:3143d81e29e1e20a9ce10901ec369012947876596f75a222235965f2b7ae832e", size = 208775, upload-time = "2026-08-03T21:19:50.918Z" },
+    { url = "https://files.pythonhosted.org/packages/b1/db/dceb9dd5b231e1da801793f8acc9f3c52a7e1afe40bb1aae37e02b0faad5/cffi-2.1.1-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:c1453022f490d2459a11819d83ad1d586e9ff65a12ac3e705ffebd46d3685dcf", size = 221822, upload-time = "2026-08-03T21:19:52.054Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/d2/6cd24ae3be000a634109c247d1475d62e5616d0dc78c82770942ec384248/cffi-2.1.1-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:208f941bb9d18e768138677f0a6d2ce01f590df56043dda1df1535ac57c88517", size = 225232, upload-time = "2026-08-03T21:19:53.109Z" },
+    { url = "https://files.pythonhosted.org/packages/cb/52/3fa190537004dd7f0ab860a6dc7c0175b8667f68d1e618a46f5498d30250/cffi-2.1.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:210019b6c7cf07f081b4c54635c8cf744377001350e29cc0f81c4377b4797735", size = 223597, upload-time = "2026-08-03T21:19:54.515Z" },
+    { url = "https://files.pythonhosted.org/packages/80/fb/0bb75b7039588c074b37ae99f40d9bfddf990ecb2fbc346ebccd2e56b9be/cffi-2.1.1-cp312-cp312-win32.whl", hash = "sha256:046bfc24911b37851ee1b51aab8bffe713d89c68c6a057b09484ce9fd5f69b4e", size = 175292, upload-time = "2026-08-03T21:19:55.566Z" },
+    { url = "https://files.pythonhosted.org/packages/d9/79/615cc094e2fb508cade7de88d3b4f6c4ec2bab695c97bce9153dc65aadf5/cffi-2.1.1-cp312-cp312-win_amd64.whl", hash = "sha256:f53e442b08449d42821fa4a4fba000095af9f62742a500f978a9f557ec44339a", size = 185919, upload-time = "2026-08-03T21:19:56.89Z" },
+    { url = "https://files.pythonhosted.org/packages/70/c6/d0ea84713fe46b243a436a18fcd47d639732747e21635c8a27191b06dc30/cffi-2.1.1-cp312-cp312-win_arm64.whl", hash = "sha256:7bde5e4cc5c10140859842b9d383af292b22639a4dffb725314baf45968cef80", size = 180093, upload-time = "2026-08-03T21:19:58.155Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/f4/035513d4117049066b4779dc3b7c0c0fdad175fa13731c9f4003f1cd1478/cffi-2.1.1-cp313-cp313-ios_13_0_arm64_iphoneos.whl", hash = "sha256:b5bdfd1c873d4e093aabc0ca84c4ca6dbc4f752afb5c86f146d9742580c9da2e", size = 194248, upload-time = "2026-08-03T21:19:59.399Z" },
+    { url = "https://files.pythonhosted.org/packages/76/af/2aeb4dbb5fc41a04161ae9ff1518de7cec08e164f44a8ce6a4cf7fd2cd1d/cffi-2.1.1-cp313-cp313-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:31348097ff5bbe827ccc41795d4dd099d9f0625e7def00ee653c137a490c2a6c", size = 196908, upload-time = "2026-08-03T21:20:00.746Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/46/2e5fdde8555706dd98139a910ca11be02809f3f605ce956f655d0214e100/cffi-2.1.1-cp313-cp313-macosx_10_15_x86_64.whl", hash = "sha256:9d2055050ea716bd38b7f7f1579c275386646b4894c155a3e2f3cd62ed41b7c6", size = 184805, upload-time = "2026-08-03T21:20:02.02Z" },
+    { url = "https://files.pythonhosted.org/packages/55/41/4c7042f317b9217502988f0873af87e16ad606dc20f84e546e3e6ce9764c/cffi-2.1.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:19ee6127ee34de7d83ce3d371ebc5ed91addbdcc39f9ab15ce4eb35a4e534971", size = 184764, upload-time = "2026-08-03T21:20:03.141Z" },
+    { url = "https://files.pythonhosted.org/packages/43/1f/1c3d90d91811c8f86ced9ed637956c54bfe5b79ca98fe976d7f8c8979f6b/cffi-2.1.1-cp313-cp313-manylinux1_i686.manylinux2014_i686.manylinux_2_17_i686.manylinux_2_5_i686.whl", hash = "sha256:6a8dddef476fab96d066d578fc88526767b836ab5ab21754e1d5bf3879c31c7c", size = 214722, upload-time = "2026-08-03T21:20:04.377Z" },
+    { url = "https://files.pythonhosted.org/packages/37/6f/3b5ce4c3b2192d250f04908f2bfd91ef34552ec8f7716a5d4abdb8d67bb2/cffi-2.1.1-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:f16c709686a78c727bbbf059f92b0bf41c6fc60deec706d2dc19f529175a6125", size = 222369, upload-time = "2026-08-03T21:20:05.544Z" },
+    { url = "https://files.pythonhosted.org/packages/02/10/4b3c75dde3d9663c9e02ba05c2668b954f671d4bbe346413ca8c696b295a/cffi-2.1.1-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:fcd22650c908d7b7da162bbfaab594a1227a15d1643a98c68b122ac642fa2264", size = 210175, upload-time = "2026-08-03T21:20:06.75Z" },
+    { url = "https://files.pythonhosted.org/packages/df/62/14f74b9543e605d17701dc797b815958b8bb70b7624ce1b832ddad48ed6c/cffi-2.1.1-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:aa9511c62d14da7aacc9b4bf51f3f697a621e83b2d6919008243c3aad168eea3", size = 208670, upload-time = "2026-08-03T21:20:08.04Z" },
+    { url = "https://files.pythonhosted.org/packages/95/95/86342356ff5953b3fb06f7ef7c5bee212d45e770abc7218d451b9148313c/cffi-2.1.1-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:a931079504ecc49efed7744c476a5c343a92fabf66dec2db95edb1b2fdc770e2", size = 221824, upload-time = "2026-08-03T21:20:09.274Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/ff/7b3429ff53aafe931ed8a5fc69f481bbef7ba6de87ddcbb63d08f483f613/cffi-2.1.1-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:a2d7755bef5a12ed488f4ef1f1b69ee9191d7396083b755a5d2295f6edb4768b", size = 225148, upload-time = "2026-08-03T21:20:10.7Z" },
+    { url = "https://files.pythonhosted.org/packages/34/34/a95870b9221e09cf4f2ce3178b1a210abdfe63a1bd357da940418d7b8d15/cffi-2.1.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:e0bcb7e0f677f543555d2adff3bf19c05f66cdb4796e5ff602442ab2fe3c4ef7", size = 223564, upload-time = "2026-08-03T21:20:12.165Z" },
+    { url = "https://files.pythonhosted.org/packages/70/ea/839b50531021a647fb5e929f72cf97bc1ff702b5472166164b5b6e76b851/cffi-2.1.1-cp313-cp313-win32.whl", hash = "sha256:334644fbac4eff73d985a17a91226df55d0f394160c4cfb880e084c8f7161cac", size = 175263, upload-time = "2026-08-03T21:20:13.559Z" },
+    { url = "https://files.pythonhosted.org/packages/60/a6/8b149b2c3f2e11aaa1618ef64500b45f50f22c57a977a4dff1aff1f91042/cffi-2.1.1-cp313-cp313-win_amd64.whl", hash = "sha256:1aa5645c30469b09530c4ebca77ebf8f17618293c58f8549cb1a543a50236e7d", size = 185688, upload-time = "2026-08-03T21:20:14.69Z" },
+    { url = "https://files.pythonhosted.org/packages/01/9a/11f687cb39d6a3504060d5242f04f48c735afb4d3d533958a20594890cb2/cffi-2.1.1-cp313-cp313-win_arm64.whl", hash = "sha256:63bbfd5ded17c4840ac07cd8f1c21ba9d9708141f840b324f422f41b207e3973", size = 180078, upload-time = "2026-08-03T21:20:15.917Z" },
+    { url = "https://files.pythonhosted.org/packages/d3/7b/d6bbf82b8b96e7391438898c42f5bd96dd02030fd5b64937d248220003e2/cffi-2.1.1-cp314-cp314-ios_13_0_arm64_iphoneos.whl", hash = "sha256:7dbb61fe3a7699468030f71bbe5f8a0e326a151daa91beb11a6fc1f980c55e1c", size = 194064, upload-time = "2026-08-03T21:20:17.148Z" },
+    { url = "https://files.pythonhosted.org/packages/94/e6/bcc91b283be94735e268487a054004f0aa19947b6348fa367db53230abc8/cffi-2.1.1-cp314-cp314-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:f24fb43132a4c6b4cb4eb029492919b2db645be6808d738f244fd146c03c32cb", size = 196720, upload-time = "2026-08-03T21:20:18.268Z" },
+    { url = "https://files.pythonhosted.org/packages/d9/99/c4b0c17cacdc9c3b8f280026286a9826d6a208c0f047591a3c3ce99b91fd/cffi-2.1.1-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:d28630f5854ab07ab1fd4aba756de52326c82e6be15d414b12793f1975048b54", size = 184964, upload-time = "2026-08-03T21:20:19.708Z" },
+    { url = "https://files.pythonhosted.org/packages/b3/a9/9db617d05d7367c1ad0ab00b3aa6e6f9281edd689b4ee9ea0e5a84e89c97/cffi-2.1.1-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:661c298b4821edebead0c91edd2b00374d67ad7c5a1f7a91d4442633b79d6a72", size = 184962, upload-time = "2026-08-03T21:20:20.833Z" },
+    { url = "https://files.pythonhosted.org/packages/67/b8/b42132ca113dc567d37684437b46ca1dafc885902b02a110a02d5b511857/cffi-2.1.1-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:58acb8ab8e295e6c5ea12f888cbb13cf21511ef2a3303a23f4325c29d17fe5c1", size = 222328, upload-time = "2026-08-03T21:20:22.118Z" },
+    { url = "https://files.pythonhosted.org/packages/80/10/c5c0cbf0a657aecf59ef511409734230bf556f05a0d6c9eed7aa5c0a0166/cffi-2.1.1-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:456a61fa52d579ebf9df2e9552ead5129855dbaff6c1e5a9b1bc408809bdc062", size = 209985, upload-time = "2026-08-03T21:20:23.401Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/6c/bfa0b87b03b9238148beca990292843c9396ba069b54496596594173de7b/cffi-2.1.1-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:a4f00aa42f75d6e4595e8866e748cc1705adc0cddfeb2ca86d0d03993d63ba03", size = 208530, upload-time = "2026-08-03T21:20:24.628Z" },
+    { url = "https://files.pythonhosted.org/packages/e9/02/4e7d553a7ac4b4238b38b3c1b80d486e9d4436f8d2acbf87a0997fe3f402/cffi-2.1.1-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:b0431303acaea1089ad4b3e9ce4e6518193def1118d4073ca848635ee4ea2e96", size = 221525, upload-time = "2026-08-03T21:20:25.758Z" },
+    { url = "https://files.pythonhosted.org/packages/82/1d/a4aaf9babd75acb4d5f223bff71533bee748dd770a382619a798960ee9ba/cffi-2.1.1-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:64faea20f4e2613363a1a9b9c7dd73058f3ecd00133a511e72ad7c511658f527", size = 225053, upload-time = "2026-08-03T21:20:26.985Z" },
+    { url = "https://files.pythonhosted.org/packages/81/10/5dc0e7bdd18e22107054288283380fc97a06ae3f1656a106908d666a3c88/cffi-2.1.1-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:5c58fe613dc5e5336357eff555824a314d8e43282600435c8d1cb6a7a2fedd13", size = 223213, upload-time = "2026-08-03T21:20:28.277Z" },
+    { url = "https://files.pythonhosted.org/packages/0b/e9/d0061c364cde06ee43168a0d076ac1da512cbc380d44767b844ba34fe2b6/cffi-2.1.1-cp314-cp314-win32.whl", hash = "sha256:1a18a57b58cfb21fc28d72e876acf10eaed67a1ed96226f92af4df681d571c4c", size = 177682, upload-time = "2026-08-03T21:20:44.288Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/06/1c3e01e3ba14c39f6d10bfbac52753b7e22259e38088e5cfe1d704918690/cffi-2.1.1-cp314-cp314-win_amd64.whl", hash = "sha256:3222ba5d678f80a030e6afbcc33dc1ae5cb45facabb61cee2c7016b8432fde48", size = 187949, upload-time = "2026-08-03T21:20:45.623Z" },
+    { url = "https://files.pythonhosted.org/packages/87/5b/da4e39efe18eeb89cf580ea9cfc66b6a7c3eadb808fc0cc1d3a295cb5a5d/cffi-2.1.1-cp314-cp314-win_arm64.whl", hash = "sha256:ab36d55f9ed2d067327667c2fea18dda018eb628dd6347aa01dda6cf1f5d3836", size = 182947, upload-time = "2026-08-03T21:20:46.955Z" },
+    { url = "https://files.pythonhosted.org/packages/23/59/40338bf421c5accea1d45158170c87006ef1cd371b05c077e76476949728/cffi-2.1.1-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:7750c6449dff7864bb9bb27ddfb0267756189201a3afc911d82b3caacd70dfc3", size = 188504, upload-time = "2026-08-03T21:20:29.495Z" },
+    { url = "https://files.pythonhosted.org/packages/7d/47/5ecf1023850036e674c77ec4de86182d309ae344e39e7cba984b7df5d647/cffi-2.1.1-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:0beceaabe56af686895136a2de78db54ecd8e4046b236b8fd6d6cb61389e9bf2", size = 188259, upload-time = "2026-08-03T21:20:31.291Z" },
+    { url = "https://files.pythonhosted.org/packages/2a/9c/92934c3bea9f785b23eba304538c0b4d37a2a96d2431eb3a1bc87a11aa19/cffi-2.1.1-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:49cbc70e6542d4ccccb936558d1064a8012541e78f821f955cff24e357776c94", size = 223864, upload-time = "2026-08-03T21:20:32.571Z" },
+    { url = "https://files.pythonhosted.org/packages/4d/45/ba4c93527bc38616a8bd36488acb69a2212d60486794f0c1f318949bbb76/cffi-2.1.1-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:e2d65b31f36619cda3999b78b2aa9632e76b78448e7a56fc4240824200e7c4fc", size = 211538, upload-time = "2026-08-03T21:20:33.808Z" },
+    { url = "https://files.pythonhosted.org/packages/80/e9/b6ef565e452acb932fb0cb5443f44a78efbd1233e566f02b5a83855e9115/cffi-2.1.1-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:28907ab9bfb6aa13184cfc17c6b8e1023c5ab6fd7076d8c20a35e59fe04f8f29", size = 210688, upload-time = "2026-08-03T21:20:34.974Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/95/eff5f0cee78d2eabc7eebffec40d3fc1876b5f3c95582e018bb4b99601f2/cffi-2.1.1-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:51b31d1c98274844cfd7838ce00bfc27c7423a4dc00fc0772fc3331c2cc90676", size = 223803, upload-time = "2026-08-03T21:20:36.564Z" },
+    { url = "https://files.pythonhosted.org/packages/fa/01/579d39fb8bef00a335a23d83757b44feb24cd6345a2c451b64cb67b9c362/cffi-2.1.1-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:5e7cecbaadb83884793e05828cee59b210b24583b9c7425d0ba6a754fe22eb4e", size = 226763, upload-time = "2026-08-03T21:20:37.816Z" },
+    { url = "https://files.pythonhosted.org/packages/8d/b0/0b44f47c60b01b57b6e2bbd92343f13a85a1d93bc46ccf6e47e244acd99c/cffi-2.1.1-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:25792eac27877609e7bb06d42ff88278a6624fff2ba9bbb523c09616b117e80f", size = 225688, upload-time = "2026-08-03T21:20:38.959Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/d2/3b7176cb570a1d3e27faf67b72f591af508036e0d8b2be2ef9af9e8c84bb/cffi-2.1.1-cp314-cp314t-win32.whl", hash = "sha256:8ef53b2de9bcb9197d31854256575d59dbac0cba72ac627bb291ef5eceb74be4", size = 182868, upload-time = "2026-08-03T21:20:40.388Z" },
+    { url = "https://files.pythonhosted.org/packages/56/78/31f00c1bcd97c9bbf55f1bfdf5bc809a5de8887473e90bb9960dca825e80/cffi-2.1.1-cp314-cp314t-win_amd64.whl", hash = "sha256:616f097f2fe415bc92a247f02e11f634e1f9e9a83d327e3c915c15089c87869e", size = 194104, upload-time = "2026-08-03T21:20:41.725Z" },
+    { url = "https://files.pythonhosted.org/packages/7b/1b/58496f2ed0a35de575250c02a43ab3cc2c04d494a88fed31c1cabc0fd176/cffi-2.1.1-cp314-cp314t-win_arm64.whl", hash = "sha256:ad2c86c495b899d862ea0f4b42891b8713a3bd45dd4105c7fd51c2a72f39f3a5", size = 186402, upload-time = "2026-08-03T21:20:43.042Z" },
+    { url = "https://files.pythonhosted.org/packages/c1/8f/9ebe220eab48a093d1a5a5e339ab0dc7316eef3bb04d63c42f0251b61f50/cffi-2.1.1-cp315-cp315-ios_13_0_arm64_iphoneos.whl", hash = "sha256:dddad92b554513a31f272570678ba307fb9f618f05e3d4a5eacafff9eae03e1d", size = 194043, upload-time = "2026-08-03T21:20:48.179Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/69/844bad3ece306c4782c2ecb93597035b6690d48704b803914c199da1e8b3/cffi-2.1.1-cp315-cp315-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:da0e573f9f97159390c89d9f1a9e41908b66d408cc5b58d08cf3847d844c531b", size = 196737, upload-time = "2026-08-03T21:20:49.457Z" },
+    { url = "https://files.pythonhosted.org/packages/1b/8a/af668013284634733f02d683458a0728739c7d6ddb5e14cb0c20832266fe/cffi-2.1.1-cp315-cp315-macosx_10_15_x86_64.whl", hash = "sha256:fb92203a88b3d3053034db775110081c49d28be6551923805e039924093761e4", size = 184933, upload-time = "2026-08-03T21:20:50.639Z" },
+    { url = "https://files.pythonhosted.org/packages/0c/75/2f5207ff6d1a613133b23a5203cc0c2a628313b5eb3974d7956ae3c57950/cffi-2.1.1-cp315-cp315-macosx_11_0_arm64.whl", hash = "sha256:2ae64be792b8966f2c69538199728b290e34726562896df1e5dc8ffd8d8188e8", size = 185002, upload-time = "2026-08-03T21:20:52.173Z" },
+    { url = "https://files.pythonhosted.org/packages/e2/31/9e1313b0a6e30e91b3b3d3fff51ae99c857c07738e3afcce1f7334e1b7ab/cffi-2.1.1-cp315-cp315-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:507a24c282e0f42f8ed737cf048572cbf580468da5555764a8331735e9c736b6", size = 222271, upload-time = "2026-08-03T21:20:53.462Z" },
+    { url = "https://files.pythonhosted.org/packages/50/e3/f6234a833e6e08c7007003074723c406559eecf9b48dfc97471e5a8eb7a0/cffi-2.1.1-cp315-cp315-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:246fa40ce8645a614ff682e0b70f37134e460eaf93a775e0cbe3cca585a67a80", size = 209919, upload-time = "2026-08-03T21:20:54.783Z" },
+    { url = "https://files.pythonhosted.org/packages/0d/fc/5f74e293fced6edb51af3a46c4ccf6c23c9943774ecb375ddbd522c76add/cffi-2.1.1-cp315-cp315-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:471cee653ae88de62096552e6d24ccb4a5adb8c8c9f10b5054d0122c15bf2779", size = 208529, upload-time = "2026-08-03T21:20:56.066Z" },
+    { url = "https://files.pythonhosted.org/packages/44/16/29e6d01b388bef055ecd6ca8244b3f4d336bd09e92d5d892187b9601084e/cffi-2.1.1-cp315-cp315-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:aeae0e330c9f6acd681f647d46cefd30c29f93e3392882e792e82080c9691399", size = 221630, upload-time = "2026-08-03T21:20:57.336Z" },
+    { url = "https://files.pythonhosted.org/packages/a4/18/fa7f1f6857d5eb88a4ca99ffcbfb7c387a287ccc154c64a73e86314745d7/cffi-2.1.1-cp315-cp315-musllinux_1_2_aarch64.whl", hash = "sha256:42a494cee34437f05546455144f2b5d9ac09b1face62bcfce597d2e521066688", size = 225134, upload-time = "2026-08-03T21:20:58.675Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/9f/e8e3dfa04a1b4c241f8c91faacad872b4d4efd051d49764ad4e2fd4b9fea/cffi-2.1.1-cp315-cp315-musllinux_1_2_x86_64.whl", hash = "sha256:cc572dace3f60ef98d7b12ff411d20f5362feb31a0439eab0085bbfd349982d7", size = 223197, upload-time = "2026-08-03T21:20:59.968Z" },
+    { url = "https://files.pythonhosted.org/packages/f8/7e/8debeb04f1ab9fe2a6963964cd6f1aaf7192627b83926586a6a4e089c9fa/cffi-2.1.1-cp315-cp315-win32.whl", hash = "sha256:4f42141fc14250de6dde5ee7ea4432be017252d91f19c5ad043c084cea629cac", size = 177683, upload-time = "2026-08-03T21:21:14.901Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/31/5158704cc474ab65c1647932e88be78dc0873f47130e253be38bcaf13d01/cffi-2.1.1-cp315-cp315-win_amd64.whl", hash = "sha256:e6e8cff14d6fb0be70a09c0bdc58096f501952d04624ebf867e0e56da2df8960", size = 187897, upload-time = "2026-08-03T21:21:16.108Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/4b/b3a2da8570c704ffc0f9762cdc3ec0f02c8573798e0b5cf7f11c82bbb70f/cffi-2.1.1-cp315-cp315-win_arm64.whl", hash = "sha256:27350daa11d4f10c540e6e89dada4c54feb7256ad03e9a4dc075ebad7ba360d1", size = 182935, upload-time = "2026-08-03T21:21:17.271Z" },
+    { url = "https://files.pythonhosted.org/packages/d0/ef/5443574510a1207e6f6bc38ba6e1f1de36cb48fef07b2728bb896a21f430/cffi-2.1.1-cp315-cp315t-macosx_10_15_x86_64.whl", hash = "sha256:c26608d2222fb1e94487e4a387d85f13eb55d5ed725cb25a0c589ac4ee60e7bc", size = 188464, upload-time = "2026-08-03T21:21:01.163Z" },
+    { url = "https://files.pythonhosted.org/packages/7e/ae/a56fa8c4686ad50e148fcbc8d3ae0d03915ff5c30d795058988c24118cef/cffi-2.1.1-cp315-cp315t-macosx_11_0_arm64.whl", hash = "sha256:4be96343e422f2dfcd12ab5c9f5aebe03f82f737c6bffeca6830b3875cb44aab", size = 188262, upload-time = "2026-08-03T21:21:02.382Z" },
+    { url = "https://files.pythonhosted.org/packages/53/b2/6187f46f2912276a3ae284076109cc5c8680482f11f766ccf26db4a86427/cffi-2.1.1-cp315-cp315t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:937c0052c05a31ca1daf18de3158eed4dbfcb9cc107adbea227728d647be701e", size = 223779, upload-time = "2026-08-03T21:21:03.553Z" },
+    { url = "https://files.pythonhosted.org/packages/8a/f6/c3ad28bd19f77047a03084424fbd4cbe997303267c14423737324be0385d/cffi-2.1.1-cp315-cp315t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:df423d40ee8654634421812bc3b196da3f9bd7d32929da813f8394c4348a5358", size = 211520, upload-time = "2026-08-03T21:21:04.863Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/cd/ccac9013a5bd9fd764de118674ab9c805b5ca10c19270d90ee273f8b2240/cffi-2.1.1-cp315-cp315t-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:a730a083190634c65cca36ba5f489531576ebd79bcd5c8e172130f6453127231", size = 210673, upload-time = "2026-08-03T21:21:06.223Z" },
+    { url = "https://files.pythonhosted.org/packages/52/86/2976131c639aead931c5bee5aba67e4b09fbeb8018b6f282f70803f923a7/cffi-2.1.1-cp315-cp315t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:363e05fa78e15116c3c32c210ee36884fd6b9afa6d440e47112c3bd511d64cb6", size = 223835, upload-time = "2026-08-03T21:21:07.539Z" },
+    { url = "https://files.pythonhosted.org/packages/ac/0c/33a7aeab2f9c76918c52e084beb39c570db3588133412929e8ec06fab90b/cffi-2.1.1-cp315-cp315t-musllinux_1_2_aarch64.whl", hash = "sha256:770de9db11e84213beec501cfcaa013b019820ca881e03344dea5844f7876d94", size = 226705, upload-time = "2026-08-03T21:21:08.774Z" },
+    { url = "https://files.pythonhosted.org/packages/e3/26/2cde30fdde421130bfc18f70395731a6e6b2053c6a1978a5258ff04e72fa/cffi-2.1.1-cp315-cp315t-musllinux_1_2_x86_64.whl", hash = "sha256:7da0c5eff80f0197f3b3d1232ec5a682a9325f4ae9016a78f5f5ca35f9ced1f5", size = 225539, upload-time = "2026-08-03T21:21:09.911Z" },
+    { url = "https://files.pythonhosted.org/packages/6d/cd/a361394c94b2129d604bb846f624a8e88255a3ee33129c434a00d715e64f/cffi-2.1.1-cp315-cp315t-win32.whl", hash = "sha256:06c72bb76605a4b0cd0aad6930b69d4baf7dd5d806cfc409b824191099700e66", size = 182707, upload-time = "2026-08-03T21:21:11.226Z" },
+    { url = "https://files.pythonhosted.org/packages/9b/b5/ba2b299993c26577d529b6ae29841f9e15b9fcf004d65f423f4fcf94ade9/cffi-2.1.1-cp315-cp315t-win_amd64.whl", hash = "sha256:d9c275eaacd24aa73f94ffd6de08fc3f932424d8b6c376f4bed7cde376fe7bc3", size = 193772, upload-time = "2026-08-03T21:21:12.39Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/29/35e016098c814cd93de9cd320c66b5bfba14dc6ecedd3cb518fa7c408c69/cffi-2.1.1-cp315-cp315t-win_arm64.whl", hash = "sha256:d18e5ac0f2f03f4f518d3e23db0f0cad7faa1da8620e9c09461d443bbf6e6692", size = 186360, upload-time = "2026-08-03T21:21:13.636Z" },
+]
+
 [[package]]
 name = "click"
 version = "8.4.2"
@@ -63,6 +244,201 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/d1/d6/3965ed04c63042e047cb6a3e6ed1a63a35087b6a609aa3a15ed8ac56c221/colorama-0.4.6-py2.py3-none-any.whl", hash = "sha256:4f1d9991f5acc0ca119f9d443620b77f9d6b33703e51011c16baf57afb285fc6", size = 25335, upload-time = "2022-10-25T02:36:20.889Z" },
 ]
 
+[[package]]
+name = "coverage"
+version = "7.17.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/78/4a/740c3134227763ebc30a226d7f2f29b25e35898d162dd8b2dd792be83fb2/coverage-7.17.2.tar.gz", hash = "sha256:d05a1bef52f4d7f1b484a1cf46a8929e50963f910e51396373f06cd3b6248f38", size = 996756, upload-time = "2026-11-04T19:52:34.313Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/5e/9d/e3db9071ebeda48e47e5be0fd0404219954e7888f64e7c37df324a79dc3a/coverage-7.17.2-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:a3f49ac9c9e5fd4b450677eb44f4b14ea9ab71950b2896888c9f6a22d5cd1773", size = 227732, upload-time = "2026-11-04T19:49:22.217Z" },
+    { url = "https://files.pythonhosted.org/packages/49/a1/260786d936940102052a51cb166f80f4a98e67fb6142aa050f1af48a2385/coverage-7.17.2-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:3d3d9d79a2b6cdcdde5a1ab1ae89953faea5cb28c0eea17a413ad997bb3cc8a1", size = 228154, upload-time = "2026-11-04T19:49:25.066Z" },
+    { url = "https://files.pythonhosted.org/packages/be/80/f5176b7f6aa9e05e37e1bb5eae473c5d015485c36206934f53b2b2795076/coverage-7.17.2-cp311-cp311-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:5b71aeaa4440cbece5498acda30838685793d3bb960aff87ec97fbb546715a5f", size = 260181, upload-time = "2026-11-04T19:49:26.523Z" },
+    { url = "https://files.pythonhosted.org/packages/03/9f/4669ca11ce1932cc18fce766ead327ceb41a92055608c179b137067e2805/coverage-7.17.2-cp311-cp311-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:01303d9e68b6e6bdc5459b54e3bd0e3539c94c25b50ac7362b7cbcacbc815fbc", size = 262404, upload-time = "2026-11-04T19:49:28.113Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/99/efefaa02a4b2876ffa4a389c81a8074c888442b12c64046b448718fa5590/coverage-7.17.2-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:1947bd9d82e405c892c50b0d8dc0c1dea5df2a962129ca238c500a6bcf887509", size = 264497, upload-time = "2026-11-04T19:49:29.773Z" },
+    { url = "https://files.pythonhosted.org/packages/19/2f/a565096e5dcf8c511332d397d712b056f06091ab3efc10adb5a4d22b0cc2/coverage-7.17.2-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:2cd1a7472a972fed01c89589b1560846e32e942f8329a515c4059d4521c6579a", size = 266507, upload-time = "2026-11-04T19:49:31.507Z" },
+    { url = "https://files.pythonhosted.org/packages/ab/09/87f9b02f97179f2c76fa5724e0ce00b9db2bbe16b7e21d89c8fc1f3a77d9/coverage-7.17.2-cp311-cp311-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:2b7fe217808239437b8509b869fde2e0cac48776a68c626bd6b15411b087e3de", size = 260297, upload-time = "2026-11-04T19:49:33.002Z" },
+    { url = "https://files.pythonhosted.org/packages/db/12/70733b58d508bc80dc983408b06f1fd0c59fde0eb1379dd9473b3e290856/coverage-7.17.2-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:565f1f1a9632d82678525d668a10fe070a285603a9d3581505b0e1a66624ad50", size = 262196, upload-time = "2026-11-04T19:49:34.412Z" },
+    { url = "https://files.pythonhosted.org/packages/33/de/0495b108a3091f2389800455b615939867a3ac19f24f0fc186f4d066b4f3/coverage-7.17.2-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:189cdffb3ebc53d6133de67952dac7cc88d1fcaff5480623fb00ef0bf1cef918", size = 260212, upload-time = "2026-11-04T19:49:38.462Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/ff/39cda949e0e9bbc16620d8b843fd78929a46edda2566e54b9597bda61625/coverage-7.17.2-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:f25209696631752468a25e5954fe119503468b3b29b6fa2c621ae766153c6f50", size = 264136, upload-time = "2026-11-04T19:49:40.266Z" },
+    { url = "https://files.pythonhosted.org/packages/85/e5/0eb1bbfc80e1a03318d81fc044dc1c4fc075921f7f618298d42837dafa66/coverage-7.17.2-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:20faaaf3a49601afbcd6d46c17a594b0ae62631498def44e5eed94789962ea18", size = 259738, upload-time = "2026-11-04T19:49:41.79Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/18/098ea8ee450922eec7ab48a35b4a7fd6a49c4a97416d1e4cf66092c24dc4/coverage-7.17.2-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:7c123b6bbc183a14372036769f033098026aa75fc8fba37d028b0b772356e90b", size = 260937, upload-time = "2026-11-04T19:49:43.467Z" },
+    { url = "https://files.pythonhosted.org/packages/8e/1c/a6ee041c4bc8b6ec7bc9f417daf89e3ee702182a48d573267ccaaed17c64/coverage-7.17.2-cp311-cp311-win32.whl", hash = "sha256:1c3146ef9d14c011517422489784a7ac344477e9cdacb05d9529e912721cd5d8", size = 229599, upload-time = "2026-11-04T19:49:45.014Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/df/7f077fb2e71b1d73fe8285be7c6ba43dc085f9eaa2384d4e8e55560073a3/coverage-7.17.2-cp311-cp311-win_amd64.whl", hash = "sha256:51c6a60e63ea993113ea5cd24a401cc2faddc54aa7acfddaffa5d3b8c0161b9d", size = 230202, upload-time = "2026-11-04T19:49:46.548Z" },
+    { url = "https://files.pythonhosted.org/packages/90/56/89dcd5907d0cc04b07746e62e1cb896c0f694e5af40aa0c980458825c6c5/coverage-7.17.2-cp311-cp311-win_arm64.whl", hash = "sha256:b08ee3ef53e80e5a50c68b3d9764363e373acba540e1b58daee0a9a7f23fdfb2", size = 230110, upload-time = "2026-11-04T19:49:48.005Z" },
+    { url = "https://files.pythonhosted.org/packages/22/6a/a51808ac625c457326fb37b174d35e1badb1324c6def5d9668089c4b14ef/coverage-7.17.2-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:289a24443352713745f79c1b6aae4e99ced2f5ff3e86bb630c33c631d50f217c", size = 227838, upload-time = "2026-11-04T19:49:49.546Z" },
+    { url = "https://files.pythonhosted.org/packages/31/24/f32ec1a5ef947294252e77c5d40ac0903ba1de4c92638edfcca8629c067f/coverage-7.17.2-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:da4b0aef427eb96e422b444e5c2c3d38768fedb9141346294c38717a8b15b416", size = 228060, upload-time = "2026-11-04T19:49:51.221Z" },
+    { url = "https://files.pythonhosted.org/packages/01/8e/3097367327c69e65521b9d9bf8b9d2ddecefa8c21bd08e17bc068bd3db93/coverage-7.17.2-cp312-cp312-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:90c6c5f93606b8803bd7f8a0b2ae05df7e35da4504a1c53cfe9294a1731e1f49", size = 260359, upload-time = "2026-11-04T19:49:52.756Z" },
+    { url = "https://files.pythonhosted.org/packages/73/65/774fc4ec86807b6ee66b46465bc49b34bb6d291e9bff6ddfa9708ccb4053/coverage-7.17.2-cp312-cp312-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:36314997533266bde3d07765289674304d61bfe49165bb1b4fa9be12cb4ba0d1", size = 263687, upload-time = "2026-11-04T19:49:54.351Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/72/17b5df5d8211e1880169b93197ba98b21b30ccf8f116284536113b7582c5/coverage-7.17.2-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:1682d98ded28524bc6853cc4e7c65175b3e917f38b2e2ddebb28cafd8ab4de74", size = 264220, upload-time = "2026-11-04T19:49:56.172Z" },
+    { url = "https://files.pythonhosted.org/packages/de/0c/603ba7fff1aa4c8064fdf4a1fff6d9fb51c72a5828429dfe858be48e38b3/coverage-7.17.2-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:8eab0a5cff8dbc563d1416a6e079ba3c146712e47167c022a5df5ea01bd76df9", size = 266498, upload-time = "2026-11-04T19:49:57.718Z" },
+    { url = "https://files.pythonhosted.org/packages/f4/ca/f2ae6e47e18b35a0dbddb9d8f51be34a6d66b41120f2e0f7363ccc0812f4/coverage-7.17.2-cp312-cp312-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:635337a96895f2ffcfe2aa7554468a988f468fb67a8007c1a65e95148c1855a9", size = 260591, upload-time = "2026-11-04T19:49:59.159Z" },
+    { url = "https://files.pythonhosted.org/packages/b2/4b/b09540a46395a6a1052ad114bf366e383c64e223374f4911a85620667930/coverage-7.17.2-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:79cd2d9742419b6d1aaeb1f3fb77a8e6a01c09ebe5bd1b27011752410a5e3781", size = 262107, upload-time = "2026-11-04T19:50:00.607Z" },
+    { url = "https://files.pythonhosted.org/packages/ec/c4/42783cb43481fafafffbc7be7fe6026258ffd30a575707733109c9ef0679/coverage-7.17.2-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:b0209fff1ca92f1e2e344d54b5b3def74efbdb46ba807cd81976a5e9e569cac3", size = 260271, upload-time = "2026-11-04T19:50:02.06Z" },
+    { url = "https://files.pythonhosted.org/packages/37/07/192ee81dd1ec4da58ae0f03fdd0045d2b821007e4194f7704d6e495733f0/coverage-7.17.2-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:7a3984fb8c2407721f9bc05573fc9a770752efc756d55068ccbde1fe53e42233", size = 264320, upload-time = "2026-11-04T19:50:03.613Z" },
+    { url = "https://files.pythonhosted.org/packages/dd/94/8d983310d98299a19ba23efbb324492f4bf8d8668d610eacd304e451f138/coverage-7.17.2-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:698ca1575135215be25ac9c5d14f0b5455135d29602b7ee81e511d64a0435c85", size = 259774, upload-time = "2026-11-04T19:50:05.363Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/85/6c923d71c76566c6c65a2af104d39d69d44ae708a700de017e6c56fedfc6/coverage-7.17.2-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:686b6f8f9e57afc3a44096b17ee8de7e11e0a12f2da819e25047af1eb3b0fc6f", size = 262258, upload-time = "2026-11-04T19:50:06.807Z" },
+    { url = "https://files.pythonhosted.org/packages/54/f9/fd3c37b09891bfdfece486a6145345bf2b32332045a678afd293a7f2f05d/coverage-7.17.2-cp312-cp312-win32.whl", hash = "sha256:ee083412170118074bcc74361fcbc7104eb6d0b7c9c75eb3b84a4c324410c531", size = 229659, upload-time = "2026-11-04T19:50:08.184Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/b8/4d395163c9bfae0e991abbd14dea9c9bbb4ade904e5f297cbfb7b8150216/coverage-7.17.2-cp312-cp312-win_amd64.whl", hash = "sha256:e269dddf5ebac20dfcc5a2a459528a9d221ab828cb31dfdf19c7cfacdbcee673", size = 230240, upload-time = "2026-11-04T19:50:09.715Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/02/1024b8d4f60a9ecc0ee41a6000425caa63855d63e51da84c93c0b1dff894/coverage-7.17.2-cp312-cp312-win_arm64.whl", hash = "sha256:bac3c79c31f45274117ed64c65efeaed85665668aeba7d809c7c38801ada6ed4", size = 230043, upload-time = "2026-11-04T19:50:11.187Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/32/d750d7b10b0a9436349b3fb78491c5bb8f9b524f01ae6994d935d77d6ab8/coverage-7.17.2-cp313-cp313-android_24_arm64_v8a.whl", hash = "sha256:882cade9b6dc43b2bc819bb444c0a13e4ed1f669a50e0de74adeec54fce486f3", size = 228978, upload-time = "2026-11-04T19:50:12.782Z" },
+    { url = "https://files.pythonhosted.org/packages/63/33/468f8c63aff5deef81bfb8e44771f68ebba328c0aa46c8a6ff27dedd0fda/coverage-7.17.2-cp313-cp313-android_24_x86_64.whl", hash = "sha256:f5a875e92f10c6463027d8151459f2d92b4c13527402ed1301eaddabd79d8cf5", size = 229048, upload-time = "2026-11-04T19:50:14.255Z" },
+    { url = "https://files.pythonhosted.org/packages/10/91/c8723e48c1497a3c56a3194973a416a6f0fb24560425685f960888e03b20/coverage-7.17.2-cp313-cp313-ios_13_0_arm64_iphoneos.whl", hash = "sha256:e8da5e158d13556457f69245deacf6d8401a2c9c31afaddd18bea691e849b5fd", size = 227293, upload-time = "2026-11-04T19:50:15.857Z" },
+    { url = "https://files.pythonhosted.org/packages/61/4f/2f57b3dc6ef31e12a99e6dcb820c4ab04d973ea1466f73c856bf920a740c/coverage-7.17.2-cp313-cp313-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:42133a2647982db7968db138c0f4a57f5836101d8d504600a87ef8ebfa22a4cf", size = 227599, upload-time = "2026-11-04T19:50:17.418Z" },
+    { url = "https://files.pythonhosted.org/packages/9c/fa/967e829238dda21c4bce17aef2f739187678c8e6e6fc880a8454945a7433/coverage-7.17.2-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:e6c89d63d43738712ce1febddb7758ffeb56de08f1b2be68aeb9a9c7fee712c7", size = 227727, upload-time = "2026-11-04T19:50:18.924Z" },
+    { url = "https://files.pythonhosted.org/packages/9d/df/803ba08e8937759dc3f18b93ece82f81b2fb446e3846e4d60a06a4e77647/coverage-7.17.2-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:f94d465ee00ebe694ca866d66bbe45fa04618b1afcb377de934694f624fa7cf6", size = 227987, upload-time = "2026-11-04T19:50:20.867Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/12/92dcd9206e7bb817af42b8663cfeefdbb2c5a6c92cc7069d43e6892bbdeb/coverage-7.17.2-cp313-cp313-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:7ce0acb27a823e8e5169282f538f0e182854cc8b472b88d45456f09b6fe364fd", size = 259154, upload-time = "2026-11-04T19:50:22.328Z" },
+    { url = "https://files.pythonhosted.org/packages/48/2d/6b028df8050caef4ce0df177686c92dba16ab7cf004040e5518f95b57021/coverage-7.17.2-cp313-cp313-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:70daa8e4b49541b51c0baeba0d802b0d14d3214daeebc071b3db0b0c7dc84646", size = 262065, upload-time = "2026-11-04T19:50:23.745Z" },
+    { url = "https://files.pythonhosted.org/packages/62/c3/429b500937ac446e36fcce517d040b0b8bd04a4bfa087bdf864175553fea/coverage-7.17.2-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:95bd8dc5b356f78f10a967ec50f8902d56f24c623753ac9fce0aba9d6213d5c5", size = 262997, upload-time = "2026-11-04T19:50:25.223Z" },
+    { url = "https://files.pythonhosted.org/packages/c1/91/263224a77de3ab1ee42d110b09f1ac9a02638794d3e002a859822638256a/coverage-7.17.2-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:a5565a9dd715a5a94ffcf9a0ad4b6b1501b5441fd67d660e78742adff5d37a0a", size = 265062, upload-time = "2026-11-04T19:50:26.829Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/44/99b72f2961f4ba54ac14ccb016f3b212cc9a9dfda4c37e07a208efe01f9f/coverage-7.17.2-cp313-cp313-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:091eba4248d31b03828fc657c96d14adfaa8754f5aec7b73298b82894858db06", size = 259201, upload-time = "2026-11-04T19:50:28.386Z" },
+    { url = "https://files.pythonhosted.org/packages/be/a7/e97f63a7c345077e4e398d15e3aa5068edc28cb061f997f71fd0e32703e1/coverage-7.17.2-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:d2742952851c7f88b1484385f68c42c6388153520efb40ff09fc852c3783aa5c", size = 261155, upload-time = "2026-11-04T19:50:29.806Z" },
+    { url = "https://files.pythonhosted.org/packages/16/0c/73e470df7db83962e2cdd6c1a7ca7dc8f8632c17a6d378d6d9124ff8bc6b/coverage-7.17.2-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:1da1999e3c371edd669b48a1029c86dc0474cdc6ff152d58cb3f15cb3337af72", size = 259077, upload-time = "2026-11-04T19:50:31.437Z" },
+    { url = "https://files.pythonhosted.org/packages/50/43/db8bc1b92d933b0b5f57d0e3377594c4f78ea31e84e8fbc22627fd17ecf4/coverage-7.17.2-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:7804a6022fcd5e1d4de4dc676e985d6aea0119249e88c041e943f3cd07953527", size = 263172, upload-time = "2026-11-04T19:50:33.014Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/f4/3e9e5cc9ccc911f8fb9595053da1ce58b9de8941b27e2f2f7058cdfc87f1/coverage-7.17.2-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:6bdf3821fd0740b5369b9ab58b4e9d0d68a2c5c75a7ee0cd3beb624f9f15e4fa", size = 258926, upload-time = "2026-11-04T19:50:34.513Z" },
+    { url = "https://files.pythonhosted.org/packages/72/9f/0d67883bf55adf50424728937cbee54d76fa137817e6bb20f97061d01816/coverage-7.17.2-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:e09c37817768bb71fe3e70b6ce5e6ac1a0cd7398536c2f30a4460218c7b66e93", size = 261006, upload-time = "2026-11-04T19:50:35.956Z" },
+    { url = "https://files.pythonhosted.org/packages/a8/22/71965edc14736073b55a40e521791d9233d5c3194fa6887a94f4431fbbcc/coverage-7.17.2-cp313-cp313-win32.whl", hash = "sha256:c10f2a2748dd084e44811bb9b26979763af9003115d9bf93c1da69011944719f", size = 229602, upload-time = "2026-11-04T19:50:37.564Z" },
+    { url = "https://files.pythonhosted.org/packages/47/0d/715cb37f51f908a6f6f33fe8c6fc95ab638b17cb014b1650daae0893c160/coverage-7.17.2-cp313-cp313-win_amd64.whl", hash = "sha256:8dc07ed34bcb206f69d5b54fd3874f7bf39ac941c9f7aec2b53b29874fcfd77a", size = 230329, upload-time = "2026-11-04T19:50:38.988Z" },
+    { url = "https://files.pythonhosted.org/packages/39/f2/a5099bdc2a530f29c818a1c7e706669451c10e5f0eb62dcff76ef3568668/coverage-7.17.2-cp313-cp313-win_arm64.whl", hash = "sha256:bb74283661a239fdaf738ac0b07db4ed9b476c7532d3e713abf0f6a072781e60", size = 230055, upload-time = "2026-11-04T19:50:40.479Z" },
+    { url = "https://files.pythonhosted.org/packages/96/f9/30d6ff7a66e1519d79940fdee542ead9a63601de60be5cc9fe62c74bab58/coverage-7.17.2-cp314-cp314-android_24_arm64_v8a.whl", hash = "sha256:0439f77deb5c023003533ae8909a9aa1e174c847d655327035b1e542c7c8a54e", size = 229094, upload-time = "2026-11-04T19:50:42.193Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/db/82c722c37dce98fe1abc953768903752bdd415dfe8cfeb7b744a7236a735/coverage-7.17.2-cp314-cp314-android_24_x86_64.whl", hash = "sha256:e86a66f96d80c770daeed78394c1d4f6e8d03e5a3e08c5dab5275d56414f296a", size = 229213, upload-time = "2026-11-04T19:50:43.779Z" },
+    { url = "https://files.pythonhosted.org/packages/7d/07/71b68d870975776cb185f11cd80e053b01739f3646488fe8b9721744f56a/coverage-7.17.2-cp314-cp314-ios_13_0_arm64_iphoneos.whl", hash = "sha256:87b30f3daa0bedda6b770b303410a6def007844772aaa143dc52675b3d95cd8a", size = 227374, upload-time = "2026-11-04T19:50:45.258Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/23/ed60f79576175e108c77df2bdc116f46e367aab108542ddeecaab752f0f6/coverage-7.17.2-cp314-cp314-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:3f219efbc3ec71c377e278dee201633e1d4ad0d2d9bdaddfd9489b2869d584c4", size = 227676, upload-time = "2026-11-04T19:50:47.095Z" },
+    { url = "https://files.pythonhosted.org/packages/10/7e/60a51850d3ff659b82cc211bc98fa126aab2ac9b81bd4ed6abc3e3720a09/coverage-7.17.2-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:36248fb6c03341501169539bcab35eb3a59159100be1246fad3c14cb73c17685", size = 227915, upload-time = "2026-11-04T19:50:48.581Z" },
+    { url = "https://files.pythonhosted.org/packages/77/80/a9539c15076fb9b95d8cbdb7f0caec90857d80bddca3eeca439f5e2e64e2/coverage-7.17.2-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:2a6281011cf85699763bf88ab55e0774f6696f87b390f39152b14ecefadccb59", size = 228072, upload-time = "2026-11-04T19:50:50.073Z" },
+    { url = "https://files.pythonhosted.org/packages/7f/3b/0a84b6032511834105fd4f8a8b4e76927783cea03dc4796032d5c4bfec8b/coverage-7.17.2-cp314-cp314-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:3dfefb1ec16ca1a01e5da40ba162e268ced8bd3624b9eba4e9384ebfa14af7ec", size = 259991, upload-time = "2026-11-04T19:50:51.665Z" },
+    { url = "https://files.pythonhosted.org/packages/2e/e4/a3e6b8bcc219b00ea91e36f071c2659b253e5d6e1b258c31eb4524231718/coverage-7.17.2-cp314-cp314-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:34e5c7a2da36804c6e6f10b368eae01ad56f5a4ac5ecce7297300a3d46fdef2a", size = 262995, upload-time = "2026-11-04T19:50:53.236Z" },
+    { url = "https://files.pythonhosted.org/packages/05/54/a666b65c5bb145d8796b7902ff1c0f60600a6c2a08949e20f2fb7af15de3/coverage-7.17.2-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:e6bf531deaebf8f69ba6015bba3fb817cab6694dfb69ac2a708889dc59a3926e", size = 263980, upload-time = "2026-11-04T19:50:55.366Z" },
+    { url = "https://files.pythonhosted.org/packages/a6/73/ac9d06da9e0c143b874a68b17d8dfeedc45acdf1bdcee5b22a42bece098e/coverage-7.17.2-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:88d4dc83b6ad09a2134cad9d8ec780b274b17ac7dfba8c2c6e92e3bc468fe85d", size = 266457, upload-time = "2026-11-04T19:50:57.04Z" },
+    { url = "https://files.pythonhosted.org/packages/87/b1/8a500e16cf787383b00b5a86eb50a490b4d8ebde505f92e1aaca515afc0a/coverage-7.17.2-cp314-cp314-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:8dc17707fd463b4dfab53792e41d50a23316ac6b98539007aa2388a1d44a8535", size = 259768, upload-time = "2026-11-04T19:50:58.508Z" },
+    { url = "https://files.pythonhosted.org/packages/f7/be/642762c5973b89e2b8bf66c95778bdd80e96ceea442ae8fa753732597b73/coverage-7.17.2-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:df0a34d445eea64f3766e9ca2ff57bcde600a89c7c0330434a7a37e8d6e2549f", size = 261831, upload-time = "2026-11-04T19:51:00.25Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/b1/f7d6c0ef0a4aecf3f91f19df4ab3fa131fec8c89f554187511716584c9f5/coverage-7.17.2-cp314-cp314-musllinux_1_2_i686.whl", hash = "sha256:c5a98aff9eb681312ed403ecb7beb5f15fd25d6e0acc2554b9ca4b4d6f0b6705", size = 259871, upload-time = "2026-11-04T19:51:01.776Z" },
+    { url = "https://files.pythonhosted.org/packages/c7/c0/3ae087d52cfa5119ad9ecbd193c40089924d1101cef7333f15a86dccb444/coverage-7.17.2-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:7565c17092f2f4021abbe3f5007300c224f362364a388f5ddad9216dab44b611", size = 264169, upload-time = "2026-11-04T19:51:03.365Z" },
+    { url = "https://files.pythonhosted.org/packages/c5/95/d324108991f892cb361ef8b2f91bd4cda9c2563e0954247409e9e6b911ab/coverage-7.17.2-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:555257578e20a46020c27b2af4ef99059cd906aa9b8e163baf9da9a5afb65a64", size = 259502, upload-time = "2026-11-04T19:51:04.91Z" },
+    { url = "https://files.pythonhosted.org/packages/14/b5/13a62eac66cecbaaa098bb753a3693b44454a4d21d53db4f1a0953f35f0b/coverage-7.17.2-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:460ba2139866e758c3a8e9d9422fdc889942bcbc5ccaf710dc4fbd8707d14aa8", size = 261613, upload-time = "2026-11-04T19:51:06.414Z" },
+    { url = "https://files.pythonhosted.org/packages/53/13/9ea31cfa72434449b9a98666760169d1e0ab31b3f6cdb12e68149106668e/coverage-7.17.2-cp314-cp314-win32.whl", hash = "sha256:e72cf9556f799c3fce7597c1bd7dbfc9104befbd08088deb3b9ae9fd98117c02", size = 229842, upload-time = "2026-11-04T19:51:08.61Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/cc/aa8f34b014979c973740f5a5ed6861ecfc6009082c70e72030ca1519e0f8/coverage-7.17.2-cp314-cp314-win_amd64.whl", hash = "sha256:205f9e329d9d5e47c320f8712326a01620689edae50531cc8934511e2c5e8f7e", size = 230474, upload-time = "2026-11-04T19:51:10.167Z" },
+    { url = "https://files.pythonhosted.org/packages/49/64/16afaa19b3886dc157c3c5ebace5241b84b96a005cb28545584e66b80895/coverage-7.17.2-cp314-cp314-win_arm64.whl", hash = "sha256:a5909dd087006c70c128297312ba67d877123e871100645d9bd73ae021a4d01d", size = 230325, upload-time = "2026-11-04T19:51:11.63Z" },
+    { url = "https://files.pythonhosted.org/packages/e8/95/acc865e1411c8ebc5c5d230367f3bfed5c605ed54bb41b84fc58f4e7f137/coverage-7.17.2-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:674bcd023a3743666d4d7a15238e57a00c968553780a36c80d3779fc410b912c", size = 228384, upload-time = "2026-11-04T19:51:13.729Z" },
+    { url = "https://files.pythonhosted.org/packages/10/98/02c37c6a928ccfc84b7a43eda44d96d3b1ccbc93989c178754b7e67e7650/coverage-7.17.2-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:ba45dc072bfbf1798e68ec81379b73473fc912174bff9f91924d77711a1d2b30", size = 228758, upload-time = "2026-11-04T19:51:15.394Z" },
+    { url = "https://files.pythonhosted.org/packages/28/ab/d503b0aaebb92b171260469463915af5e16a64457b289d4cb844e8c366ac/coverage-7.17.2-cp314-cp314t-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:0d8a5dc709da9b90ad5cc859a9b88c9b801e65ca2fbf7cbdbed5b9cbf457fcc9", size = 268749, upload-time = "2026-11-04T19:51:17.179Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/e5/6d6ba15bde22fcccd07e14305be14291d041f732771a73f787297445d3e7/coverage-7.17.2-cp314-cp314t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:248873a144c067f981742ff4bbfb48b57e281a8cb7a3821d4e293bdb50b47970", size = 271301, upload-time = "2026-11-04T19:51:18.893Z" },
+    { url = "https://files.pythonhosted.org/packages/63/e7/bd6dcec5b8130f5bd8679087a2bc3a50a53c4ee78d5ec449610020088ff3/coverage-7.17.2-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:d0332e2b27fc5cc761d6b8a33118b958e6a46be7f00fd30e03a5cf103350c0b3", size = 273924, upload-time = "2026-11-04T19:51:20.605Z" },
+    { url = "https://files.pythonhosted.org/packages/55/c1/b3f06aa1f1c51f4295fdfa6500eb7409aaa6273cf5f27bafc25217f3547d/coverage-7.17.2-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:27fc4384a1154f7df30d304ccddc05ef457368c065670ecbd392606279b3329a", size = 275412, upload-time = "2026-11-04T19:51:22.09Z" },
+    { url = "https://files.pythonhosted.org/packages/a7/f0/b68ab3654af3541488b26856e3043c13c782d8e6104fc8149746ecaa83f0/coverage-7.17.2-cp314-cp314t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:603140eeae3f9adc562f91b1b98d4d1fc491bd1f66c5082482c568d0b7891bb1", size = 268638, upload-time = "2026-11-04T19:51:23.653Z" },
+    { url = "https://files.pythonhosted.org/packages/fd/16/4a9d56bd4ca4572cbd20f9843813623cef1b88b15f979ec4f381704d2f84/coverage-7.17.2-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:be0fec33b69c40f845c76f67fb4495b62a84da8c31a579dc6e18c5a63fa6a1f3", size = 271211, upload-time = "2026-11-04T19:51:25.678Z" },
+    { url = "https://files.pythonhosted.org/packages/78/d2/1c04b38bab92d2b7d62718d170b5bea43755fefee7e29cc056448c433d92/coverage-7.17.2-cp314-cp314t-musllinux_1_2_i686.whl", hash = "sha256:960e199965e506d78f62252355397a05c8cee8072ad2d82d932745517d566539", size = 268638, upload-time = "2026-11-04T19:51:27.262Z" },
+    { url = "https://files.pythonhosted.org/packages/26/c9/2c639e9aee78b0522cb3dc245de09685e34b479bcc45d4d2a277d0de1174/coverage-7.17.2-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:d7a363c0788435ff5324d9582d37c63f215c75f974d755cfd6cfc9fbe0e64b04", size = 272935, upload-time = "2026-11-04T19:51:28.96Z" },
+    { url = "https://files.pythonhosted.org/packages/79/1f/11bdaf03c1b12f88094b57420b4238d3974ebec6a7d674b645a54e24f90c/coverage-7.17.2-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:afd81658f17b1a50bbc1d247a61fa435be0be471246136eb946f9cbfc437a4fa", size = 268057, upload-time = "2026-11-04T19:51:30.44Z" },
+    { url = "https://files.pythonhosted.org/packages/bb/f6/43d40d1b4d4892e54c68a241cd5b92efed4d5934109e0e5e24a94759f732/coverage-7.17.2-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:d88fcc24470d73ed4360e910f8549718b913ba56fb8775d9ef929a647835dfea", size = 269986, upload-time = "2026-11-04T19:51:31.913Z" },
+    { url = "https://files.pythonhosted.org/packages/8e/33/6874185b791c71684c401fc74abd71bbdb102e8ee41c8f380cf25af41d29/coverage-7.17.2-cp314-cp314t-win32.whl", hash = "sha256:2c42c222939b8699e7bc0e453149627f211ebbbb2f74c1a04331b0cd9834e2c8", size = 230160, upload-time = "2026-11-04T19:51:33.304Z" },
+    { url = "https://files.pythonhosted.org/packages/16/e0/9057b4cf962ca6089b144f0d93a748f5e2d13876dd0f33f9d5a2c2ec49d2/coverage-7.17.2-cp314-cp314t-win_amd64.whl", hash = "sha256:b94c509e26603ba7f8cb1bf8bb63967c7be533493be5668d8442cd06ec853d76", size = 231086, upload-time = "2026-11-04T19:51:35.002Z" },
+    { url = "https://files.pythonhosted.org/packages/5e/4f/bd626297c942380279dff323e1d8a8937990d553119a4f887358488b1b54/coverage-7.17.2-cp314-cp314t-win_arm64.whl", hash = "sha256:eca90e028932de597e2c50f454ad8cc631281e14d20b9f801a649ab555deb580", size = 230657, upload-time = "2026-11-04T19:51:36.742Z" },
+    { url = "https://files.pythonhosted.org/packages/ac/92/ff8badc05ff0c4ed26ca62fb3d155e9014ff65768b76d5f399e63d9e9a79/coverage-7.17.2-cp315-cp315-android_24_arm64_v8a.whl", hash = "sha256:cbf751ae86ef0d80e719915c087b05776c8d9300141f6c3e56f536d78a62c301", size = 229092, upload-time = "2026-11-04T19:51:38.222Z" },
+    { url = "https://files.pythonhosted.org/packages/5a/8b/c5a5392e5a5dceb68f3b1b8cdba925c7997699f351d811cd4a41add9c29e/coverage-7.17.2-cp315-cp315-android_24_x86_64.whl", hash = "sha256:249c4b4eaac9ced6fb85e465027ca26348111c2760108fffc356a16be4f54cd9", size = 229212, upload-time = "2026-11-04T19:51:39.738Z" },
+    { url = "https://files.pythonhosted.org/packages/7b/bc/9259a1fc49ad663861cbfb3df6a99d4c8f62a11b242a2db3358822d28b17/coverage-7.17.2-cp315-cp315-ios_13_0_arm64_iphoneos.whl", hash = "sha256:e2fd4e664a34854cae8db58ca6132fb7b5a7efc67b14233e797194bd0d63b6b0", size = 227390, upload-time = "2026-11-04T19:51:41.16Z" },
+    { url = "https://files.pythonhosted.org/packages/20/ad/83f03da8ab846af246d4a47b651e5d90229a4c3314e31e8eecade63b378f/coverage-7.17.2-cp315-cp315-ios_13_0_arm64_iphonesimulator.whl", hash = "sha256:0712a43e39410aa567f2e85846490f8dd6c839820e7edef2142767c5c03162ba", size = 227690, upload-time = "2026-11-04T19:51:42.658Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/08/e110687f24245edbbe9c0986a6ccd04f1f9a6e90e329cbd4347e2b81d76e/coverage-7.17.2-cp315-cp315-macosx_10_15_x86_64.whl", hash = "sha256:298849ca0e385767096995cb57f72059b469f43f9927b8393f29d134f7bb1062", size = 227922, upload-time = "2026-11-04T19:51:44.376Z" },
+    { url = "https://files.pythonhosted.org/packages/93/24/7cfcd6adb4a0c18a10de12fd695edbf8cd121fdca0a6a63cea1bffc029fe/coverage-7.17.2-cp315-cp315-macosx_11_0_arm64.whl", hash = "sha256:81a432793440edef268dbadd493393bd6f70fa4b87f76c58114f7f77f1ccfaea", size = 228094, upload-time = "2026-11-04T19:51:46.108Z" },
+    { url = "https://files.pythonhosted.org/packages/54/7a/af167a0bb6d0564209d35c8039b290327ecf7b3e34f838f9360b56d3a03c/coverage-7.17.2-cp315-cp315-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:d14872ccef35972c4ac290f2432f43d0a7bb230cae2b5ed26871ab86221e8b5f", size = 259940, upload-time = "2026-11-04T19:51:47.599Z" },
+    { url = "https://files.pythonhosted.org/packages/f5/c6/4f3931c3ff80a6f2608209181adb00527970a4b43b64c3aa323383c37d51/coverage-7.17.2-cp315-cp315-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:3bd065e75c077d6de8cd3fe68699a8b47be3ec595af6b66e3629926839094609", size = 263632, upload-time = "2026-11-04T19:51:49.047Z" },
+    { url = "https://files.pythonhosted.org/packages/3e/71/31a4945459008952061147ea9b85853902507d865a7272a9f64be0c4a093/coverage-7.17.2-cp315-cp315-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:8d3626b9816f7eadd0993c3703a1d8ed124b579cebe5201b446f1c0d551fa245", size = 264713, upload-time = "2026-11-04T19:51:50.569Z" },
+    { url = "https://files.pythonhosted.org/packages/82/6b/a4eb258b0373034f8f19aeea4c1bc4c89942b5b228812ee9952f033dc611/coverage-7.17.2-cp315-cp315-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:c9639c2ea019c948b52067a0f74485039eb84b7a2de828ba6d178e663fb2b8bd", size = 267091, upload-time = "2026-11-04T19:51:52.09Z" },
+    { url = "https://files.pythonhosted.org/packages/02/ae/9410f2f4bbaa698ff3869c7c09e0fa10d74482a1ec8040063157612f07a0/coverage-7.17.2-cp315-cp315-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:19d508b0611486f8e23e28abcba77795ee865ff0e0cd936349ba692c8d0d8ca4", size = 260326, upload-time = "2026-11-04T19:51:53.508Z" },
+    { url = "https://files.pythonhosted.org/packages/ad/ee/97549ec1bdf6ff6d17612dbcf4b2205daa74510273ac1efd1460e3db275c/coverage-7.17.2-cp315-cp315-musllinux_1_2_aarch64.whl", hash = "sha256:cfe64d2501806a04507217852a3132a9a9076321435500bf3b11943a5c872732", size = 262595, upload-time = "2026-11-04T19:51:55.514Z" },
+    { url = "https://files.pythonhosted.org/packages/36/72/76e04605522a6dd81bbf43e1b407ca611f415c04b67e18c123ee440b1d69/coverage-7.17.2-cp315-cp315-musllinux_1_2_i686.whl", hash = "sha256:4274acd35aae5bbbd0908792260819b9720b171ccc099a8168f7c20ef5d6ab3a", size = 260546, upload-time = "2026-11-04T19:51:57.068Z" },
+    { url = "https://files.pythonhosted.org/packages/30/8d/163e027635790ab232f3ec0261d2a26bec34c377bea2096554261444d0f5/coverage-7.17.2-cp315-cp315-musllinux_1_2_ppc64le.whl", hash = "sha256:85bccf6fe19ea3747147387971465f6a06197d6b9f6b644a97ba90ca5b09c5cd", size = 264877, upload-time = "2026-11-04T19:51:58.575Z" },
+    { url = "https://files.pythonhosted.org/packages/18/35/11dd585a06be350285d42c17aa2fccd0af18d962b6979f03dd1a258eb705/coverage-7.17.2-cp315-cp315-musllinux_1_2_riscv64.whl", hash = "sha256:d5024913651813801fd43b65b6409b0d50f8bae95316c8f1512dfbd8ca96cb1f", size = 259858, upload-time = "2026-11-04T19:52:00.361Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/ed/f1f3b4bf6081122bf1820b1f38352377a75a2d5f39bb6331598e165b64af/coverage-7.17.2-cp315-cp315-musllinux_1_2_x86_64.whl", hash = "sha256:99b64a12fe6017c254a8027790e0eaa22eaeec201e7dfda5eaac176a6984ef27", size = 262401, upload-time = "2026-11-04T19:52:02.02Z" },
+    { url = "https://files.pythonhosted.org/packages/ab/bb/61e07a606a9f4d0f5391ac9b62b1f008a997f87860ad233f99833fd6e6bd/coverage-7.17.2-cp315-cp315-win32.whl", hash = "sha256:74d91af590514dda16165d5d7cfa94183150c6a6a80a99f61068369ae3959455", size = 229840, upload-time = "2026-11-04T19:52:04.813Z" },
+    { url = "https://files.pythonhosted.org/packages/86/40/2d4980d3374a023a34c5ea7cd5d2b93c02c5588a324ca7faf8a0a8c7dbac/coverage-7.17.2-cp315-cp315-win_amd64.whl", hash = "sha256:075566a44289afb634ceaafa7d8d377bb2667a5b4a90fbee2609efdcd015c66e", size = 230461, upload-time = "2026-11-04T19:52:06.727Z" },
+    { url = "https://files.pythonhosted.org/packages/f8/c8/b307327b1256f9ed8ffc3271db041913835cfee065fbaf45105978093c08/coverage-7.17.2-cp315-cp315-win_arm64.whl", hash = "sha256:be699e76b57fede8920a0f568eff23b270d9004414b7cf6744bdda851638be6e", size = 230322, upload-time = "2026-11-04T19:52:08.191Z" },
+    { url = "https://files.pythonhosted.org/packages/40/18/0912e37f23c101faebd7c5e544c6ba6bd750715f81f2a2c7ea66f83a2295/coverage-7.17.2-cp315-cp315t-macosx_10_15_x86_64.whl", hash = "sha256:ffbaadf8612781358b3f949ad68dce26c5a35beaafcc48125fc231dbcce7d362", size = 228380, upload-time = "2026-11-04T19:52:09.892Z" },
+    { url = "https://files.pythonhosted.org/packages/5e/a0/c4ce9bbf82b2e9dbf2e0326004c8c37d87a275f515fc7bb22344a6162050/coverage-7.17.2-cp315-cp315t-macosx_11_0_arm64.whl", hash = "sha256:d4004fce7b3a8ae5ef2af835670763f12723e9b9d74837697607b89a17f77312", size = 228776, upload-time = "2026-11-04T19:52:11.351Z" },
+    { url = "https://files.pythonhosted.org/packages/3f/05/9c7429c87589534755398a58fe9837fdb2870a22d99e87623fcb261e1d4e/coverage-7.17.2-cp315-cp315t-manylinux1_i686.manylinux_2_28_i686.manylinux_2_5_i686.whl", hash = "sha256:a838a10afb5b60a6cc6315348b176badaf2409d821208a3e3cda1dc608129e23", size = 269129, upload-time = "2026-11-04T19:52:12.815Z" },
+    { url = "https://files.pythonhosted.org/packages/e9/22/d1ad2ea7c8871d66f8453d33cdeec39986e6e1f2a104628e9bcb171f0209/coverage-7.17.2-cp315-cp315t-manylinux1_x86_64.manylinux_2_28_x86_64.manylinux_2_5_x86_64.whl", hash = "sha256:0fc17882975fe485cfc95fb2f20eed937e05e0c0d8ffa5048857cda3aa838e8a", size = 271967, upload-time = "2026-11-04T19:52:14.685Z" },
+    { url = "https://files.pythonhosted.org/packages/0d/1d/5038de4bf6549903ec3d86959c6f18aff54911616b47aa96f4d6a5660c93/coverage-7.17.2-cp315-cp315t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:a65faa1ee98e090a5fd7c116f6d3ab5c6a85fcc46849b8494835608715836399", size = 274667, upload-time = "2026-11-04T19:52:16.122Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/ea/68a26b4b5eb255d92de906fd66e8d720b1df15e705949ea9a9cef2cc7f8b/coverage-7.17.2-cp315-cp315t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:7c17f716c837db550a202e7732cdfaa726b8515cba88be42193616913970d223", size = 276001, upload-time = "2026-11-04T19:52:17.639Z" },
+    { url = "https://files.pythonhosted.org/packages/70/86/0f4238f09b22bc03a907346fabcabe5449626879cdedbc1edd362ab0e570/coverage-7.17.2-cp315-cp315t-manylinux_2_31_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:545ca42488c7f0e62324fb2621aa05737db843b75e84e65a271bbf976f496f66", size = 269687, upload-time = "2026-11-04T19:52:19.169Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/ac/1885255425900f691c543d88394d9f0dacd2f2dc78422e660c747ca9c95c/coverage-7.17.2-cp315-cp315t-musllinux_1_2_aarch64.whl", hash = "sha256:8de787f533b13aeeea5d7139610eadb56f249cc739840b973603d1d18d0fb023", size = 272158, upload-time = "2026-11-04T19:52:20.714Z" },
+    { url = "https://files.pythonhosted.org/packages/02/d6/0111601342d91e25d13e22a55f34600aa387c55b5027b90e78d941911821/coverage-7.17.2-cp315-cp315t-musllinux_1_2_i686.whl", hash = "sha256:485b2ed9e13b7e9209276843d7147e2f1cd1c816582655650a64c8f922093c58", size = 269182, upload-time = "2026-11-04T19:52:22.204Z" },
+    { url = "https://files.pythonhosted.org/packages/70/48/d9bdc5346a9ad09711f55b6901ee05b57305e6b2b66e6edfd50f81f0d410/coverage-7.17.2-cp315-cp315t-musllinux_1_2_ppc64le.whl", hash = "sha256:a472e23a7514478e1c8124ea056424d681e3173975650b0a06b6181658f1009a", size = 273790, upload-time = "2026-11-04T19:52:23.677Z" },
+    { url = "https://files.pythonhosted.org/packages/98/75/3a4d8ce4aa59ed2e898364acf923b39471689d51876bb978c42e664cdb79/coverage-7.17.2-cp315-cp315t-musllinux_1_2_riscv64.whl", hash = "sha256:0a623de5c57c5c3f3aed830c73a3a5aad91dbf76d53bc30ec161be758c8ca408", size = 269277, upload-time = "2026-11-04T19:52:25.19Z" },
+    { url = "https://files.pythonhosted.org/packages/4a/11/d15082e504e7852a25848ee0dcb59453579ec923c6d1f3010316e1fb6118/coverage-7.17.2-cp315-cp315t-musllinux_1_2_x86_64.whl", hash = "sha256:2ad189c65706306644399e48530ad1aea1dfb311bd21d988df1ace422d09f3f8", size = 270890, upload-time = "2026-11-04T19:52:26.745Z" },
+    { url = "https://files.pythonhosted.org/packages/f1/9d/6460101b0191afae9ed84c8d8136cc8cc09675f376ce08acb3118b8c27be/coverage-7.17.2-cp315-cp315t-win32.whl", hash = "sha256:6fd6f218e39a621a30dbaf9543831fa10fe713afc8a44b52fc42cfe277412609", size = 230148, upload-time = "2026-11-04T19:52:28.164Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/f2/3462d9616445a8cb36ec2e027d1c0ae82f6f90f224d9851ba0b22b7425d6/coverage-7.17.2-cp315-cp315t-win_amd64.whl", hash = "sha256:ef07aae0a666ef5edcab5bc1bb590468c6f4120a8cdad50a010d042a59ab6e77", size = 231074, upload-time = "2026-11-04T19:52:29.714Z" },
+    { url = "https://files.pythonhosted.org/packages/4c/06/abeca0cf853e77aba9464d4ada4603c8b6e744b667c13e1d4eefecc487af/coverage-7.17.2-cp315-cp315t-win_arm64.whl", hash = "sha256:c68f64d96857749a215657c172f7144ed026063489686b901774f271997923c2", size = 230648, upload-time = "2026-11-04T19:52:31.267Z" },
+    { url = "https://files.pythonhosted.org/packages/da/91/1805cc144497d76a436f66a21fa57492bee7ed1257826fb992f03b9b2b6f/coverage-7.17.2-py3-none-any.whl", hash = "sha256:e674027ceb6bfd959f1bb035000fd20fa8b717dc6765adaaf8bca347822c8c7d", size = 219280, upload-time = "2026-11-04T19:52:32.726Z" },
+]
+
+[[package]]
+name = "cryptography"
+version = "50.0.2"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "cffi", marker = "platform_python_implementation != 'PyPy'" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/9d/af/182eb91b0df3fe75c4d9f26fe70684569566745f6ba7e5c9c73a862c5252/cryptography-50.0.2.tar.gz", hash = "sha256:7b46165bb56eb4704e2eaaf86f3c940d19154535d9b0ca7d6d590b04060e00d5", size = 880623, upload-time = "2026-09-30T15:30:04.884Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/e5/56/d194340cc4a57535e82e1bee9e89667ac4b7c13b5d3f59686deae3094dd5/cryptography-50.0.2-cp311-abi3-macosx_11_0_arm64.whl", hash = "sha256:fa8f5efb344d6908a1ce62f4a24e2e5780f825d6f53f5f50ec5ffacac72936cb", size = 3914904, upload-time = "2026-09-30T14:43:44.339Z" },
+    { url = "https://files.pythonhosted.org/packages/d9/69/c9bd862c3bf43d6399c433caf002df16e2dffd4be49bdf515cda38038711/cryptography-50.0.2-cp311-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:79def8d059362e7831389ed3be0ecdf58a89386e1271e35dd9f5af84e81bffd0", size = 4731146, upload-time = "2026-09-30T14:43:47.113Z" },
+    { url = "https://files.pythonhosted.org/packages/21/69/64cef1f702bf6657e0cc186ed1a2891d50d29fb41586b254e1c07adea261/cryptography-50.0.2-cp311-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:630ebfea3bf689d075f82316324ff7433dc447fe6bc1bfc76524b74b4a9567d2", size = 4719841, upload-time = "2026-09-30T14:43:49.01Z" },
+    { url = "https://files.pythonhosted.org/packages/38/6b/61a3f8d8c5e1e49a6cddccafc4015cc1c0021360ab0acb4080e7a423644a/cryptography-50.0.2-cp311-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:f9f6143a8c75945eb960d9eb98905a441394abfa24afaae239d514ffb2586480", size = 4738340, upload-time = "2026-09-30T14:43:50.932Z" },
+    { url = "https://files.pythonhosted.org/packages/7b/2e/7212ca32fd43dc91f2f41db20160b268098874b4c9a0e7be94d6835f5b2e/cryptography-50.0.2-cp311-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:a582ab2ae1d34f67112cadc86702774c9ea4374df6bca6afe672817203c99134", size = 5367029, upload-time = "2026-09-30T14:43:52.911Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/f1/b474e930c4d910328780e3940da76f5aa5cbc48ce1fc14e44d239d9ea9db/cryptography-50.0.2-cp311-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:4061c0079120205fb760c58acab6443e217307dcf05e3702cf970e0689972856", size = 4753050, upload-time = "2026-09-30T14:43:55.272Z" },
+    { url = "https://files.pythonhosted.org/packages/7c/52/9af10e80ac16b0fcc2123f9cbd5e7afbd0fd5075bb7a607c592258a39cda/cryptography-50.0.2-cp311-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:ac9ed99d81760c62fe89d5f0815cdfa1ba9a35141cf30f1c2d044f04b4803d2e", size = 4376724, upload-time = "2026-09-30T14:43:57.24Z" },
+    { url = "https://files.pythonhosted.org/packages/71/37/6202e488cc1eb625ea110c292c6bda92823176e023f427d8d5660ce8d632/cryptography-50.0.2-cp311-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:87e9ce85beb6b328ba370cc6e6aea483c92617b4c95b1d33a49297eb662bfb04", size = 4737859, upload-time = "2026-09-30T14:43:59.541Z" },
+    { url = "https://files.pythonhosted.org/packages/8f/30/e86d7d518489b0ae2497091a35287abcb1a2ce4037837a34afbe9b1d6964/cryptography-50.0.2-cp311-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:f265528741e048bce55c3463ed721fb0aa45a5888d8add8cfeccb3035451bbdc", size = 5324103, upload-time = "2026-09-30T14:44:01.901Z" },
+    { url = "https://files.pythonhosted.org/packages/d3/69/2c833a049475e0a3444e94c7d0aca0aa51d166374a449b09e92ac98138de/cryptography-50.0.2-cp311-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:9dab55f57c74c3cad24c323bacbbd04be4705ba6eb0d92e920b1fc4837ed5079", size = 4752576, upload-time = "2026-09-30T14:44:04.545Z" },
+    { url = "https://files.pythonhosted.org/packages/6c/5d/906970b83bbfc1f5bbfb677a143c181f2801f23b6a7204a3b47c42c97e65/cryptography-50.0.2-cp311-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:25784ce8b9621c90c643efb9e1e2162ab3b0224cae446ad5e70e7fcb1ce18b51", size = 4870819, upload-time = "2026-09-30T14:44:06.884Z" },
+    { url = "https://files.pythonhosted.org/packages/68/e3/f2298d3bb55e0c4a91841ec4d01b3f020ba8c5fbf15ccdcc6dcf03f97025/cryptography-50.0.2-cp311-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:85d0d9a31b9098e98534226d5686b47264b95e62ce459dc2e62fdfc809f9fe93", size = 5030152, upload-time = "2026-09-30T14:44:09.443Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/4f/adfc442765721292fff86d314ce385d3249d22db42295c0dd057727b60f3/cryptography-50.0.2-cp311-abi3-win_amd64.whl", hash = "sha256:7afa5a6602a9f29af1f3a2965f831bae7c9d5d597b7cbb716d41ab3b7d89879c", size = 3824692, upload-time = "2026-09-30T14:44:11.671Z" },
+    { url = "https://files.pythonhosted.org/packages/ce/cb/52eb3770c0d0be2702a98c6e96065ddc0a2877cf0845aa9c23397c142cd4/cryptography-50.0.2-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:f785f6161f202ab04d8ca194158968798e480ca058943907972da5f12e2881e8", size = 3892731, upload-time = "2026-09-30T14:44:13.485Z" },
+    { url = "https://files.pythonhosted.org/packages/19/8e/aa1fc533d4546b127b45de8aa024eb5933d23eff9debfe25931e56861095/cryptography-50.0.2-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:0ecbc5652bdb6fc9eaf89a7d196e20941adfe812f43bc4ca05d9150496821047", size = 4710431, upload-time = "2026-09-30T14:44:15.427Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/64/72bc3f75176e7e406b748a3e3830432b8c51297b38368713df04dc04898a/cryptography-50.0.2-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:ab50ee449bf968271e820086f10a33d101dd060370abc10bcd22279be2656539", size = 4694824, upload-time = "2026-09-30T14:44:17.69Z" },
+    { url = "https://files.pythonhosted.org/packages/4e/c6/62c77550edfa5ca3f14bf44a1e6739b9fa09d6e998a11d97ed8213bccc98/cryptography-50.0.2-cp314-cp314t-manylinux_2_28_aarch64.whl", hash = "sha256:a9f7355e6fab51f6c369b86fb7571cffa05edee2c2121e0380a37fb9ac1cd5c1", size = 4716967, upload-time = "2026-09-30T14:44:19.661Z" },
+    { url = "https://files.pythonhosted.org/packages/f4/37/cce70f150c432914460157a6ecc161752e053aa5ec0ef3b3f7dc6e31039a/cryptography-50.0.2-cp314-cp314t-manylinux_2_28_ppc64le.whl", hash = "sha256:94e5e9f108ee10471288214d3d233fbfbb492840a8457eb85178d643ddeb32c7", size = 5328676, upload-time = "2026-09-30T14:44:21.744Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/9a/6f2f0304d634ceafdeaf23e84537336664ac419b5d07611675c2ad3f6b7a/cryptography-50.0.2-cp314-cp314t-manylinux_2_28_x86_64.whl", hash = "sha256:241449bf940a5d27309bd317e6f9a2af6932113818bb2b8f5c59ddc7ef16da18", size = 4727698, upload-time = "2026-09-30T14:44:24.178Z" },
+    { url = "https://files.pythonhosted.org/packages/1d/de/66bcf9244d118663b2e1aaded8990f4640e3d7b7411870a5765f252074d2/cryptography-50.0.2-cp314-cp314t-manylinux_2_31_armv7l.whl", hash = "sha256:d8947001be83df1394050758ce0e745dd74fb134eef0a4b5124208dfc3a68c37", size = 4354821, upload-time = "2026-09-30T14:44:26.263Z" },
+    { url = "https://files.pythonhosted.org/packages/bd/e6/db28a28c7b6c676addce89136de3d8db49ea825a8c863472e36e42ead4ad/cryptography-50.0.2-cp314-cp314t-manylinux_2_34_aarch64.whl", hash = "sha256:4a20ce1e5cb4284a86692fdcba7cb8754185c6b2e5c56fcef3751cf451d3cdc2", size = 4716748, upload-time = "2026-09-30T14:44:28.447Z" },
+    { url = "https://files.pythonhosted.org/packages/30/96/01546c7f69ea0e2ab790a2e4f0934a4052fb9b388147fbf83c2fd72f1e57/cryptography-50.0.2-cp314-cp314t-manylinux_2_34_ppc64le.whl", hash = "sha256:84f964e537f916e2cc85199e5a88742e964939b575ac8598b3f9d6cc416cdaf1", size = 5285085, upload-time = "2026-09-30T14:44:30.704Z" },
+    { url = "https://files.pythonhosted.org/packages/6c/01/03263395f74d50b071e9e66daace3f8bef80493e5d410726f2ba8554736b/cryptography-50.0.2-cp314-cp314t-manylinux_2_34_x86_64.whl", hash = "sha256:828d49b0ff5a0e3975865571c5d91dbbdd0d38d8289b249a163e9425413a5e05", size = 4727268, upload-time = "2026-09-30T14:44:32.92Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/94/2bfe8f29ec0cc9c0d99359c4161adf32858e4934b72c6d100d2ac0bbe962/cryptography-50.0.2-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:deb9fde5c60e437ee4821bc9bc39ff31b42135c27e1dc61ef0a629389c1de62e", size = 4849503, upload-time = "2026-09-30T14:44:34.969Z" },
+    { url = "https://files.pythonhosted.org/packages/54/44/e80651ecbf0e42b62e2bb5f5768916e07eea72e1297338956a61df361f88/cryptography-50.0.2-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:8c71ba2cd31fc93748c38e1b613200ff1c2665cbfd5341fe3a61cfde35a1430e", size = 5004057, upload-time = "2026-09-30T14:44:37.064Z" },
+    { url = "https://files.pythonhosted.org/packages/f8/cc/1d33befb3cd7ea7e77d2d73f43f2066471da1b21f24a6156efcaabf6d2e8/cryptography-50.0.2-cp314-cp314t-win_amd64.whl", hash = "sha256:78198641e5be9521beea5aa782bb551a58068d10e6eb04c9c680c1b69f2e7d45", size = 3795868, upload-time = "2026-09-30T14:44:39.71Z" },
+    { url = "https://files.pythonhosted.org/packages/2d/49/93f6a6e7a87c9aa68d44d3e1cdb5fe8f60c90d5d2f46acae9a56892816b8/cryptography-50.0.2-cp315-abi3.abi3t-macosx_11_0_arm64.whl", hash = "sha256:edc3342adf8f697fc5f59c887a304356f147b397809440ed64e2fa6af2f50f37", size = 4133708, upload-time = "2026-09-30T14:44:41.807Z" },
+    { url = "https://files.pythonhosted.org/packages/8c/75/32ac2a56243d778805c16ca6a32b8f74fb757df7e28d7ecb560afafb59cf/cryptography-50.0.2-cp315-abi3.abi3t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:d370b8d1dfcdf7130178137f6fbee6140774a1acc6cacefc4b42643ec11d0a3a", size = 4956267, upload-time = "2026-09-30T14:44:43.693Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/a4/2c8d734e43d97f0842ee9f1b7b4bfb3d0cf5e19edebf43c2afe6675c2320/cryptography-50.0.2-cp315-abi3.abi3t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:f2f9bd7f90c64fe89253f0a2c05e3c4856072660429ce8831b4235bf29403a67", size = 4966465, upload-time = "2026-09-30T14:44:45.769Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/58/ee288c829a6f41f6235ae9dd33d82fd19b45442b65b4c8a3da36963d9f7a/cryptography-50.0.2-cp315-abi3.abi3t-manylinux_2_28_aarch64.whl", hash = "sha256:e275096ea1e60cc595cda2836fd4a6c725d1125108b868be17f53684d164e2cc", size = 4959356, upload-time = "2026-09-30T14:44:48.211Z" },
+    { url = "https://files.pythonhosted.org/packages/92/20/9ded6d51ddd9897f6b6e81fb9ebea7951d7cc5d6c890b0ed8abf77a51a80/cryptography-50.0.2-cp315-abi3.abi3t-manylinux_2_28_ppc64le.whl", hash = "sha256:b13478603dcd0a2479ff8e87e2c19a7d525734686fe3c49542472293a204212d", size = 5548822, upload-time = "2026-09-30T14:44:50.86Z" },
+    { url = "https://files.pythonhosted.org/packages/02/a8/8df951850d6b31d2a00218f19e2b3f999523437ed7a819df7fa427942fca/cryptography-50.0.2-cp315-abi3.abi3t-manylinux_2_28_x86_64.whl", hash = "sha256:58a0c478eeca76fe5e07993c5a0703def34a6dc6a0cda4f5564639b33112ffe7", size = 5001199, upload-time = "2026-09-30T14:44:53.379Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/f9/36b3022218ce75b7cdf068fb95f809f9bd0d820e4955ef43b90c255cc7ac/cryptography-50.0.2-cp315-abi3.abi3t-manylinux_2_31_armv7l.whl", hash = "sha256:d38cdff612d06fa6a32840d5e1b1f7a27cee4a349aa9085d94a67789d6bfd408", size = 4629333, upload-time = "2026-09-30T14:44:55.635Z" },
+    { url = "https://files.pythonhosted.org/packages/8c/72/20f99a219f6af47cdd1cbd978c243b92d71496e168a746138af44ded4f29/cryptography-50.0.2-cp315-abi3.abi3t-manylinux_2_34_aarch64.whl", hash = "sha256:fdd28f912fccfec1846a94e2e1e8f9b0012f557f0c46fe4f3eb0d7a87afcf90b", size = 4958822, upload-time = "2026-09-30T14:44:59.639Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/20/196f112617fb08eb4d608a2a6c422373d46f9cc2857f38fc0667033c0899/cryptography-50.0.2-cp315-abi3.abi3t-manylinux_2_34_ppc64le.whl", hash = "sha256:cbc8738fd8526d80f35cb3a40d41f41a2e7030bb3b18b09a6778ef63d291c2fd", size = 5506351, upload-time = "2026-09-30T14:45:02.267Z" },
+    { url = "https://files.pythonhosted.org/packages/24/95/83378121ef3eaaaf71d4b781577ff794acb39b9e1b87a3f156898c8497ed/cryptography-50.0.2-cp315-abi3.abi3t-manylinux_2_34_x86_64.whl", hash = "sha256:e105ab60406787da31fccc883fc0f733af1efd78f0136a4599692c4083a73d0c", size = 5000859, upload-time = "2026-09-30T14:45:05.009Z" },
+    { url = "https://files.pythonhosted.org/packages/22/f7/70fd7ae4d1dbfa7ba29b02e1b9068771519a86027756510b700ce81086a8/cryptography-50.0.2-cp315-abi3.abi3t-musllinux_1_2_aarch64.whl", hash = "sha256:6f8700550aa1474a91e5dc07049c46f98b423b5b1ddd0483e0b51362eeeaf5be", size = 5092151, upload-time = "2026-09-30T15:29:15.932Z" },
+    { url = "https://files.pythonhosted.org/packages/d4/be/688367b74de86984bd58d8efacfc7c9e68b89a6a22ced0fb4f38db50254a/cryptography-50.0.2-cp315-abi3.abi3t-musllinux_1_2_x86_64.whl", hash = "sha256:c71be1cbfa5cd9a41ee452acf1eccd82b2c05950358b106ec8ceb83411d1a020", size = 5286120, upload-time = "2026-09-30T15:29:18.309Z" },
+    { url = "https://files.pythonhosted.org/packages/39/d1/55f8a3f2ef5d1529e16835ef10cf0fe3d559ce237b46dddc440c0bba3649/cryptography-50.0.2-cp315-abi3.abi3t-win_amd64.whl", hash = "sha256:c423ab384a46c4dff7217b2ea5ba2e11cffdeab6441acd04cf65a369caf0366c", size = 4111557, upload-time = "2026-09-30T15:29:20.155Z" },
+    { url = "https://files.pythonhosted.org/packages/23/ad/ac987755d00e1e64273760228d2635ae38dae2be83e3c6e0d3289d91dec3/cryptography-50.0.2-cp39-abi3-macosx_11_0_arm64.whl", hash = "sha256:0ec5f09541743261e66e291b4a0cbf0fb2997aeaab6d9e9c740b9dba1b58d1c2", size = 3943588, upload-time = "2026-09-30T15:29:22.265Z" },
+    { url = "https://files.pythonhosted.org/packages/d5/8d/6d585339bedf85d45044c85d8412dac53f2bb6f918e8b7777efba1787844/cryptography-50.0.2-cp39-abi3-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:c5e67125c7dca78d199ec4e116aa93dbb83494808ecbb8211a2cb09b1bf41dbd", size = 4756166, upload-time = "2026-09-30T15:29:24.58Z" },
+    { url = "https://files.pythonhosted.org/packages/bf/f1/1c1f6874e8550cfddd4b688ceb38cefb6ed15ceed224d56f133f3d88c214/cryptography-50.0.2-cp39-abi3-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:ee247f5c245c9a2fe7c8e2214e295918838e44e00a45a6718451e4004219e767", size = 4749145, upload-time = "2026-09-30T15:29:26.807Z" },
+    { url = "https://files.pythonhosted.org/packages/c1/63/61b15dc1a8de03fe0adbe3fd7608b3ad5c73bf50993bbcb1faaa930afe33/cryptography-50.0.2-cp39-abi3-manylinux_2_28_aarch64.whl", hash = "sha256:dfe9763530994147d9af1def057a5b9658b00e8f8fe8743d144d1e0911c2e454", size = 4763638, upload-time = "2026-09-30T15:29:28.588Z" },
+    { url = "https://files.pythonhosted.org/packages/fc/35/b345bdfa40c9126df1a9d33236aa98418367931b8725f84fc3ae2b98dc59/cryptography-50.0.2-cp39-abi3-manylinux_2_28_ppc64le.whl", hash = "sha256:58ddb5a8e3179d12f19e4ea34d2d32e9d63a4baa142c875c1eb59f41b7243acd", size = 5382217, upload-time = "2026-09-30T15:29:30.589Z" },
+    { url = "https://files.pythonhosted.org/packages/4f/87/ef344a9e616871f2519c22d6afcda79ddd5d35e9592d95eb6e677608d055/cryptography-50.0.2-cp39-abi3-manylinux_2_28_x86_64.whl", hash = "sha256:f21e8a22c8605750c7af886bab299a363721264061b4ac0a30efb73cfd58efc5", size = 4781387, upload-time = "2026-09-30T15:29:32.605Z" },
+    { url = "https://files.pythonhosted.org/packages/90/5b/f2fdb13cd0b96f6f932c8627bb292a45f11c64d21620a8e120aee9a3b848/cryptography-50.0.2-cp39-abi3-manylinux_2_31_armv7l.whl", hash = "sha256:9c8402a82ea0dc4ceeab793db05f0fafa8ca139ca34fcde5df0f596103c74107", size = 4403790, upload-time = "2026-09-30T15:29:34.374Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/ce/7e4f662b1e3c393513569e402cfc85ac7da0bd3d5435e122a3140219eb2d/cryptography-50.0.2-cp39-abi3-manylinux_2_34_aarch64.whl", hash = "sha256:0ddc924c04591c2811ca024d62ecad4f7f6f08af8939c211438f48a16bd23602", size = 4764319, upload-time = "2026-09-30T15:29:36.149Z" },
+    { url = "https://files.pythonhosted.org/packages/3c/3f/86ff33ce34cc0de6847fb96e035a1a760d81652e38643f617c02ad32ef7a/cryptography-50.0.2-cp39-abi3-manylinux_2_34_ppc64le.whl", hash = "sha256:a6557e5f38e065ca9fbdaf7cfc7435ecb1d113aa81a022d1b51921ee7432e227", size = 5338560, upload-time = "2026-09-30T15:29:39.053Z" },
+    { url = "https://files.pythonhosted.org/packages/40/cf/6b5c8e2fd9202d98988ab7cb5cc5c991704c4ad55f492ff408e4969f83f1/cryptography-50.0.2-cp39-abi3-manylinux_2_34_x86_64.whl", hash = "sha256:1981f1db4630889b9ef7803fadef12b056f428cb6b85c27ba57b774793b6093c", size = 4780973, upload-time = "2026-09-30T15:29:41.251Z" },
+    { url = "https://files.pythonhosted.org/packages/10/bf/8d6ebc7dded797bd0f0160d52188021211f011a2b164ef0ae1dac4587465/cryptography-50.0.2-cp39-abi3-musllinux_1_2_aarch64.whl", hash = "sha256:7a8701d6b584d76e909e3d305b7d126b41439876a5aaf76cddc67fc230eafa2e", size = 4897738, upload-time = "2026-09-30T15:29:43.106Z" },
+    { url = "https://files.pythonhosted.org/packages/d4/aa/f3f6e0de7e6253b8baa8b2d8fb9d50924fa75cee3d4624bd4bc1208ee923/cryptography-50.0.2-cp39-abi3-musllinux_1_2_x86_64.whl", hash = "sha256:ce47f66801c20ec6c6632453bb5960fe38939e9306970b48b3a5a26de7745d94", size = 5058280, upload-time = "2026-09-30T15:29:44.827Z" },
+    { url = "https://files.pythonhosted.org/packages/f6/b6/a1faf3a27ae9405fb34b1713cc73b2d8a26b04d5c561578fa2e6ef3e5bb9/cryptography-50.0.2-cp39-abi3-win_amd64.whl", hash = "sha256:4e81d95e5bafc2d6e34e4bed780e53e4d5b9a2f928573428aa4d35fbec1eb0de", size = 3854095, upload-time = "2026-09-30T15:29:46.782Z" },
+    { url = "https://files.pythonhosted.org/packages/1d/7a/f08d34ce09d60f89ebd391e2ebc6ba2b995e6dd7552f41820f8085f94e53/cryptography-50.0.2-pp311-pypy311_pp73-manylinux_2_28_aarch64.whl", hash = "sha256:92e665960f25fcdc73725b9cec7a3824f279ba97a98653afe9ffac2e43668f67", size = 4716035, upload-time = "2026-09-30T15:29:48.681Z" },
+    { url = "https://files.pythonhosted.org/packages/45/67/e18fb65592451a2acb76e9f2fbe14e0f47a8318b4c5430f1633851d03daa/cryptography-50.0.2-pp311-pypy311_pp73-manylinux_2_28_x86_64.whl", hash = "sha256:eef4c2f3423810b3070ab391f85436d2f8bbfcb286ac15cbc73190b3563b1f1a", size = 4726917, upload-time = "2026-09-30T15:29:50.608Z" },
+    { url = "https://files.pythonhosted.org/packages/83/28/38fdce17e60f6b825e69fc3b7f75e70a6612759980704697e1de4cbfaf6e/cryptography-50.0.2-pp311-pypy311_pp73-manylinux_2_34_aarch64.whl", hash = "sha256:7c6d0330c472d96f6a6afe24d80dfdf15176c33096f0a4397ae4c60f3dd3be48", size = 4715341, upload-time = "2026-09-30T15:29:52.522Z" },
+    { url = "https://files.pythonhosted.org/packages/b6/b1/d9121a717e0f893c64bd6ca7702614778d7df2a5c309128a002421788516/cryptography-50.0.2-pp311-pypy311_pp73-manylinux_2_34_x86_64.whl", hash = "sha256:1ba34f04897fcdaa73f74145c25f3ec146fbd56593853e88adc2e811303c5f42", size = 4726322, upload-time = "2026-09-30T15:29:54.263Z" },
+    { url = "https://files.pythonhosted.org/packages/36/8b/e6d153808bf353e152abd2fd4d8f09670d956ac78379ac46e60d7efbf04c/cryptography-50.0.2-pp311-pypy311_pp80-macosx_11_0_arm64.whl", hash = "sha256:3dc4fd8058cea1644971207d530e1a03a184a805ffc8ebdddf0599d78a331b81", size = 3873097, upload-time = "2026-09-30T15:29:56.097Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/1d/1271f287ff7170ddafc2aad36260c4eec20ccd2fea70f38455e9d56d427b/cryptography-50.0.2-pp311-pypy311_pp80-win_amd64.whl", hash = "sha256:7b75de3c8b3be1cdb1052747c929440c3eea46c1bc2cb8a6e3a48388e9b7b452", size = 3805376, upload-time = "2026-09-30T15:29:58.729Z" },
+]
+
 [[package]]
 name = "fastapi"
 version = "0.139.0"
@@ -79,6 +455,105 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/9e/7c/8e3c6ad324ea5cb36604fc3f968554887891c316d9dfde57761611d907ad/fastapi-0.139.0-py3-none-any.whl", hash = "sha256:cf15e1e9e667ddb0ad63811e60bd11390d1aac838ca4a7a23f421807b2308189", size = 130339, upload-time = "2026-07-01T16:35:32.19Z" },
 ]
 
+[[package]]
+name = "grimp"
+version = "3.19"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/43/fc/0b137fc880c64387a5d46d44f6ff2f7f8a9de19c35d94c667d4bd52dbdef/grimp-3.19.tar.gz", hash = "sha256:0dfc88e2e2d5ffdd67a951a5341623b3889d6f616586ecdf7a34809e02f4e463", size = 835435, upload-time = "2026-11-06T10:41:15.421Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/6d/69/54824c8bf33f92ffa26a5983166a6a0a71d7d3048ce11dd0cf4d9d163fbb/grimp-3.19-cp311-cp311-macosx_10_12_x86_64.whl", hash = "sha256:8cfef92a9ad94a9a71c27b9896a68cb2fda304fa5bfb5f2bfdc5d936a999470f", size = 2154332, upload-time = "2026-11-06T10:38:29.223Z" },
+    { url = "https://files.pythonhosted.org/packages/7a/69/1632eeae3178ca19291491cf63de9066fc7fa32f9dd4545eed7c554f8438/grimp-3.19-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:9d9c9b9f82c264411cd9801dc4f349a0f970e01045a56633a6d68328c91d7703", size = 2112532, upload-time = "2026-11-06T10:38:31.656Z" },
+    { url = "https://files.pythonhosted.org/packages/1e/47/066226988777d6d20c7806997d79bf19712219d5ea9a751ddf41fb0a952a/grimp-3.19-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:1e4dfca365eee8ca9ede29b48cbe66d4064649abded4e876c80c395f2bd9810e", size = 2281277, upload-time = "2026-11-06T10:38:33.347Z" },
+    { url = "https://files.pythonhosted.org/packages/75/82/57357f14920139571614f818ef31e0556bd515bff63b71759be3bbfa96fb/grimp-3.19-cp311-cp311-manylinux2014_armv7l.manylinux_2_17_armv7l.whl", hash = "sha256:e1463a52ea1294bfbc32c787180e9d3c45128e8aca27af70b8372cf7a5f98c87", size = 2232465, upload-time = "2026-11-06T10:38:35.032Z" },
+    { url = "https://files.pythonhosted.org/packages/66/80/20de99d34a73bfb7de32986104f2441eff8d098fc33f517b2b5d2df7f32f/grimp-3.19-cp311-cp311-manylinux2014_i686.manylinux_2_17_i686.whl", hash = "sha256:41f442326a2a93f94991eb801214cbb67653757cbdc218125af4eee9f0444433", size = 2376438, upload-time = "2026-11-06T10:38:36.922Z" },
+    { url = "https://files.pythonhosted.org/packages/d4/ce/e90f251b2b8ece33c96988d3e38e1a9bdfc1159bfe6e9a1789f211dfa340/grimp-3.19-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:5856699d0c0a41613130c71f680505a8d5bc5636f7e4798b60c0c1fe40d79301", size = 2639217, upload-time = "2026-11-06T10:38:38.842Z" },
+    { url = "https://files.pythonhosted.org/packages/56/d1/e8ef1c7fd7b5e1cdc5c0f49b7bb1b47ee4bf45cdeb2ec1db229b44665f74/grimp-3.19-cp311-cp311-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:f89f30db7bd0852b9ed9a34a56cefa715d8eebca7ef4c9cc4479efdaf2df3ea3", size = 2365505, upload-time = "2026-11-06T10:38:40.499Z" },
+    { url = "https://files.pythonhosted.org/packages/a4/dd/8672a019aa9ec2120448fe1437f2185c87510b3db254a91438020c897c6f/grimp-3.19-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:2f5c9d0ed032e686da9bef72db3657975ea07c5c0be31e6b2c2fe02d7e6ef9f1", size = 2297937, upload-time = "2026-11-06T10:38:42.203Z" },
+    { url = "https://files.pythonhosted.org/packages/22/9f/12341f31355dc3c110c36de90f03b3b27ed1b3fe0619f6cd048387fde131/grimp-3.19-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:857f7f9527b20b03db00cef40d2fba329a83eaa5f1d4a157f31f887bc1097d4d", size = 2460486, upload-time = "2026-11-06T10:38:44.089Z" },
+    { url = "https://files.pythonhosted.org/packages/94/30/c95d2e5b2f73752aa4b8530bc4f24fba324f93cf1671a480048b8f04a2df/grimp-3.19-cp311-cp311-musllinux_1_2_armv7l.whl", hash = "sha256:a9a34176c244c08af26b25e16e987ac57d7b37b009cae016e380b21b5c275c57", size = 2503628, upload-time = "2026-11-06T10:38:45.897Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/18/d891cea432f7107d1a2b1f93d700d6be918ed09439963a3da23bd4429e73/grimp-3.19-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:b574bb2702c0889fddc2adecf1a89106f2f59b0fa8bfaede267dd11bbe756534", size = 2538228, upload-time = "2026-11-06T10:38:47.523Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/d1/000eebd43bd7a3e61293d5a75c1320469e60c03555e46a225cb99ebc3eb6/grimp-3.19-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:91f92a8565024e86956ff3338aa53bffbccfe288b1d745192c75ef696fa30189", size = 2555680, upload-time = "2026-11-06T10:38:50.212Z" },
+    { url = "https://files.pythonhosted.org/packages/65/b2/a40e560e99ca0ff9cf30aff2e6a272282ff0bad82ca34bbff0259c6c80b7/grimp-3.19-cp311-cp311-win32.whl", hash = "sha256:ea825f117ed67b62bc76e0cff0a52d7c0ff49dc8155ca8b05eef415cf3776dfd", size = 1882366, upload-time = "2026-11-06T10:38:52.107Z" },
+    { url = "https://files.pythonhosted.org/packages/11/68/6dae302700da16da9d42ab43c7201fbdb37d769afed81a25edf03f697e37/grimp-3.19-cp311-cp311-win_amd64.whl", hash = "sha256:e1766ef8f6393d2736939fbf05a0795bffd6a9b150ea00682623d487371fa595", size = 2011934, upload-time = "2026-11-06T10:38:54.181Z" },
+    { url = "https://files.pythonhosted.org/packages/76/a6/ddd4f1126df56cf697f1968da21a80f43d57147ae49b1f67b8be136e0024/grimp-3.19-cp311-cp311-win_arm64.whl", hash = "sha256:ca517eb85599db377a8e334f179a80a2da7d94bc2ca268127a9b8747fed99f00", size = 1929511, upload-time = "2026-11-06T10:38:55.777Z" },
+    { url = "https://files.pythonhosted.org/packages/f4/dc/d4e14202d5691f6de0b3a0e8474818e251c4276caa89c3bc268baf0c22be/grimp-3.19-cp312-cp312-macosx_10_12_x86_64.whl", hash = "sha256:a187ea59c4fc22b2daec35b40d90deaf961a4152a1528c38b45ca3a88cf0f1c7", size = 2155644, upload-time = "2026-11-06T10:38:57.582Z" },
+    { url = "https://files.pythonhosted.org/packages/6e/67/6bf31b99aced61245dcac3e1e7af7144ef6e74185ae0a139e018dd318253/grimp-3.19-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:176c062f04768f11993bfe0ef1f4d425b8cb731c3072d5de4b597146e94295d0", size = 2101374, upload-time = "2026-11-06T10:38:59.19Z" },
+    { url = "https://files.pythonhosted.org/packages/7c/6a/5ac35c21a9840f4fccb8928f70c85e4108898ad8d438ab44d0840ca6d9e1/grimp-3.19-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:efd886053ddea60d76c6a70b5f1d6ff74cc933f018c1ffd0ebd7267063456769", size = 2276727, upload-time = "2026-11-06T10:39:00.916Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/18/0811115b03a32c4b485a9027a4f1b67196650dc7db0329f68144aa268ad6/grimp-3.19-cp312-cp312-manylinux2014_armv7l.manylinux_2_17_armv7l.whl", hash = "sha256:1413200cd956317853d407d9a03bc6b3b68a82ae03a6e3966942ec078e4b090a", size = 2227451, upload-time = "2026-11-06T10:39:02.79Z" },
+    { url = "https://files.pythonhosted.org/packages/12/f0/eaf991f8da6030c94b48db74e28190aed7f5f19745c45763886807391644/grimp-3.19-cp312-cp312-manylinux2014_i686.manylinux_2_17_i686.whl", hash = "sha256:5d0ab86af8b894760c297598e71eac01b015c96fd9df612ce3fe2d30b88477fb", size = 2367591, upload-time = "2026-11-06T10:39:04.737Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/2b/498d7d0e95249cbb5eebf2884bfbe547390962103b4ec90560faab1204ec/grimp-3.19-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:3724a228d02e009fb6a5fd269a54a8015d50982cc35be63c07aab8185eb0672f", size = 2630255, upload-time = "2026-11-06T10:39:06.342Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/49/db53e18b45630e1a3056cb3a8c196e54836b91f20f29eea1e73240d57cd2/grimp-3.19-cp312-cp312-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:e1232a89c13425af42f42df1eb47390a411d802185c37264f844610346214bfa", size = 2362241, upload-time = "2026-11-06T10:39:08.218Z" },
+    { url = "https://files.pythonhosted.org/packages/55/58/8e5a206fabce8a13eafe6ecc92fb3f6b15d49a63bb1f24430e546ccf0f9d/grimp-3.19-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:6d8b13447b15e626d0b44db58d38e4781c4bcc066ca4ecbcef59eafe19839b30", size = 2290308, upload-time = "2026-11-06T10:39:09.932Z" },
+    { url = "https://files.pythonhosted.org/packages/03/88/ee76329ecdd890395fc11eef8a84d5ec3bf8e1a696dac3c60c258f2594da/grimp-3.19-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:9dce687f05078babd98e3b009ebdd29c5bfb56759242e275a603be2a95db9975", size = 2454745, upload-time = "2026-11-06T10:39:11.582Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/79/b7e9b8ad6b717ae9749471643ee7362bdd5c5ea3f3942c3b6d20846898b8/grimp-3.19-cp312-cp312-musllinux_1_2_armv7l.whl", hash = "sha256:23d70c651914dfb1814dac97286602417e02598c82fc7ff0af2617dfed50cb78", size = 2501229, upload-time = "2026-11-06T10:39:13.546Z" },
+    { url = "https://files.pythonhosted.org/packages/7d/fb/4aec670116c97909adef18797a34c4c3e925954b25d38ee9c7e8e603a29a/grimp-3.19-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:bb26ea087ad80e9e63086bbd6b99985aea78a5a905a3e7d34276c8028610f3ec", size = 2529074, upload-time = "2026-11-06T10:39:15.276Z" },
+    { url = "https://files.pythonhosted.org/packages/d8/0d/8f19d69288b033e68676e18e757092ae608dda9cef31888e51d68f72582b/grimp-3.19-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:bb2218f2d88ea5f94bd5baea714076595262e3ebfbc24552bea0bb2fbd4c13d7", size = 2547564, upload-time = "2026-11-06T10:39:17.202Z" },
+    { url = "https://files.pythonhosted.org/packages/51/f8/1d8b02c9d1a155867d854abc73fbc2d21df9eee2921ccdc50997e9060e33/grimp-3.19-cp312-cp312-win32.whl", hash = "sha256:5dcf3be7f414acff10d379e3cfffcfe073b54d8eef6bb98a7aaafc104bf1f32d", size = 1879818, upload-time = "2026-11-06T10:39:19.16Z" },
+    { url = "https://files.pythonhosted.org/packages/dc/70/35cfe672ee3274f2ede13447f75bac629fd21e0440fd28f8cb873f0358c2/grimp-3.19-cp312-cp312-win_amd64.whl", hash = "sha256:2f97e8218dbf6f04a1cb8e40addc2a955d0cb042191acaa4743e6fb8dd0dba71", size = 2008979, upload-time = "2026-11-06T10:39:20.78Z" },
+    { url = "https://files.pythonhosted.org/packages/85/ef/5f5f94e96ded439076797d54cb009d69aff3e3bc2fec42c73fd045f58d6b/grimp-3.19-cp312-cp312-win_arm64.whl", hash = "sha256:72e581569d6ffa0da6e5aa2b60123995c9fe2ff52bf9c1dc4df64931ad32bed0", size = 1925933, upload-time = "2026-11-06T10:39:23.555Z" },
+    { url = "https://files.pythonhosted.org/packages/49/e5/3bf5c17b6a7b611738789b27c7b383eaf1764aa7f0f98623d52bf0fb342d/grimp-3.19-cp313-cp313-macosx_10_12_x86_64.whl", hash = "sha256:5cc79888d840df830bdc4c2fcaeaad40e3ac128a7bba634b1c19218609e7f19d", size = 2154644, upload-time = "2026-11-06T10:39:25.264Z" },
+    { url = "https://files.pythonhosted.org/packages/64/11/f06cf078a6e6d7877725337254a473068cb388a242b11abe784e9b7457b6/grimp-3.19-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:4c324097e6321d123e203f63e213d3780b2d87fc3f45bab04245068a3e8198be", size = 2101704, upload-time = "2026-11-06T10:39:26.973Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/56/3188dd5507f30d27ab3e7a2f2072052336c6180de02cf7fd5f7734e2d837/grimp-3.19-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:63975f15f00482b9895b7b496123e84c5dd23ea8375460742f02815bce00b727", size = 2277626, upload-time = "2026-11-06T10:39:28.655Z" },
+    { url = "https://files.pythonhosted.org/packages/0c/03/deba252aa8414133907acaa9c6dbf9f6f4b6cb6ee94ca788507417ad2028/grimp-3.19-cp313-cp313-manylinux2014_armv7l.manylinux_2_17_armv7l.whl", hash = "sha256:35e6384f8dc41de31776e741b27a386dc8ff97244f25a93175465e4de9d85bbc", size = 2229145, upload-time = "2026-11-06T10:39:30.245Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/53/7019c4302f736fc62acb8d843695eab3e5bd424e070e007e9a7e84dade2a/grimp-3.19-cp313-cp313-manylinux2014_i686.manylinux_2_17_i686.whl", hash = "sha256:553db6e638ba0ab50de96bbb3cd7572d3f03623f38b21e94d5900ea61108ec4c", size = 2368536, upload-time = "2026-11-06T10:39:32.218Z" },
+    { url = "https://files.pythonhosted.org/packages/8d/6a/18218d2b04d58e5467ff892348d29ed0f85025cbbc5c7ba7b47a4356eb51/grimp-3.19-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:6192714479174decd3a086515f0e540bd4a8f62808db450883e1d68e8e35dfb3", size = 2631943, upload-time = "2026-11-06T10:39:33.909Z" },
+    { url = "https://files.pythonhosted.org/packages/2c/b8/ca319cc69e6c448078abdf738041a365e65b47b46fe2f4a40c2fd8a81011/grimp-3.19-cp313-cp313-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:173ccdd342aef2d9daea2374e33a3360782ccb66f9e3588edcbd8b87effda301", size = 2361497, upload-time = "2026-11-06T10:39:35.65Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/40/625f9c39d969b8d6238971c031f5b537dda34b15c6092b04149d6dabca76/grimp-3.19-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:8e49ad99b0c62dc70dfc5771e798ee142dfa9661bb62986cc84bf08f57343356", size = 2290664, upload-time = "2026-11-06T10:39:37.278Z" },
+    { url = "https://files.pythonhosted.org/packages/52/29/c7b0d7ae577c7b03c7df9d3a3470792897e7b864ee661e14f4bb584cdf72/grimp-3.19-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:4c47cf5e2382bee32c468dfdaea7844fc24c9a68919cac519a8114200e88f1e5", size = 2455259, upload-time = "2026-11-06T10:39:39.173Z" },
+    { url = "https://files.pythonhosted.org/packages/6e/90/c6d4eeff7262078b27b0d4849570882d78b3ce1544b5a15a8d7dee7c10f7/grimp-3.19-cp313-cp313-musllinux_1_2_armv7l.whl", hash = "sha256:3cdfee95f8502fc7cb120d44c38cb1d960aa074ccbedfc2558dcd66c69aee067", size = 2501560, upload-time = "2026-11-06T10:39:40.814Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/a9/2fc04c2b16603cc3a84b49a4ca6393a1bbd36cfe0d5da72cf51a6e82d3ea/grimp-3.19-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:c775c62df632bc2ae46365460551e2d5090e4e2a57c4c35ea241501cf6a5e7b2", size = 2530664, upload-time = "2026-11-06T10:39:42.725Z" },
+    { url = "https://files.pythonhosted.org/packages/66/08/c9b3bcd0627bd67b1ad55bb71ce77faf45fa806b02aca0b898a775696019/grimp-3.19-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:b86b11f98e9b815972690906b939a2956a30630c44a9e87eb93b2d44175978d8", size = 2548032, upload-time = "2026-11-06T10:39:44.486Z" },
+    { url = "https://files.pythonhosted.org/packages/73/dc/6e3877739a739ac5c3e020075750a2aa561273d7a0f5d108a439cc5e39cb/grimp-3.19-cp313-cp313-win32.whl", hash = "sha256:2403597415654d4f4473ae1eabcb73a8e3b6f07aec6c75210891665f2029d509", size = 1879072, upload-time = "2026-11-06T10:39:46.447Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/3f/7f273dfc9c65126a5f344383bc8eab8384419d580209f02c022dd0a0c0a3/grimp-3.19-cp313-cp313-win_amd64.whl", hash = "sha256:a0a0228efc9d6b258cdeda87b1187dffb8428a1622d5430d47eb7112b211a26b", size = 2008454, upload-time = "2026-11-06T10:39:49.417Z" },
+    { url = "https://files.pythonhosted.org/packages/62/aa/85aca1395d216d05f926a466cf7e3a14d62ebd8ebacae12c4d738a716163/grimp-3.19-cp313-cp313-win_arm64.whl", hash = "sha256:9c2a25d9e46769926e186645e0eba61f6171ecd2a2426968fd5e4d77703c4266", size = 1925920, upload-time = "2026-11-06T10:39:51.154Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/57/551df30d8a39abf86c5687163eb36638e088a873a29e7749981e7b768c45/grimp-3.19-cp314-cp314-macosx_10_12_x86_64.whl", hash = "sha256:b4ea9a89413b5b1fb2c74331a9f3e223671a16d1fc7ea3a92de1ec8cedfe48b6", size = 2155858, upload-time = "2026-11-06T10:39:53.103Z" },
+    { url = "https://files.pythonhosted.org/packages/1d/2f/75a3841aaae31f89360f6abda5c3c1ecc59e1d3db537d404b48f86edbda6/grimp-3.19-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:149f51cf3a43a749509c6e9d878c973f0292a51e7bfb02cf8ed554f30726369a", size = 2101358, upload-time = "2026-11-06T10:39:54.824Z" },
+    { url = "https://files.pythonhosted.org/packages/36/83/6d0e1d2b564bb91b5911f6c807c3f08200f1342c8ff9094f2022b8a6b29a/grimp-3.19-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:40f301cefa8a7b8f206c6b628ad147af404131dfe51aa58e66ae7cbeade33d2e", size = 2275633, upload-time = "2026-11-06T10:39:56.621Z" },
+    { url = "https://files.pythonhosted.org/packages/13/5c/51620761046e4afdf354d9fe5b2d5347beda38cd28212f2908b266097af8/grimp-3.19-cp314-cp314-manylinux2014_armv7l.manylinux_2_17_armv7l.whl", hash = "sha256:3479e8e45a022d4f7a954ab21f388e71aa2fab366498badb4e1204e68e9e91ce", size = 2228981, upload-time = "2026-11-06T10:39:58.383Z" },
+    { url = "https://files.pythonhosted.org/packages/2c/f5/febc38eaba5954e94f0867651c570c7abc90ff946105dec5e37a791303ef/grimp-3.19-cp314-cp314-manylinux2014_i686.manylinux_2_17_i686.whl", hash = "sha256:195916cd90397cb5a1009e2f3d9ade1a2c8ebdcc01076dfda82b419e9ab7c589", size = 2368803, upload-time = "2026-11-06T10:40:00.478Z" },
+    { url = "https://files.pythonhosted.org/packages/0d/57/9a739462ddc58a8a611d676a366e5e9ba2e36d2df5ef73378b5e805274b7/grimp-3.19-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:cbd313cdadcfdb5885073d60303a25ebaa5ee7d445c73242c16befa0093d208c", size = 2632078, upload-time = "2026-11-06T10:40:02.503Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/44/70496b7adb4b4a433a17be90dc0812a59aac26b6c38577d15625c81d4b2a/grimp-3.19-cp314-cp314-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:6f847085c0ec2159b2c88bc672036a8436a314fda95ee7fd05bc2b5fd77a3b13", size = 2363248, upload-time = "2026-11-06T10:40:04.509Z" },
+    { url = "https://files.pythonhosted.org/packages/88/33/ae852eac1c68ceff95606b0bee79fac84c5b9dbfa1620b70361637861824/grimp-3.19-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:a80c4ad4d8265a9a7d22256bc1f8070242d518c4d6f1b7471c9300e6d7dd998e", size = 2291350, upload-time = "2026-11-06T10:40:06.489Z" },
+    { url = "https://files.pythonhosted.org/packages/0d/69/63eb27a7c994fe3135576d63143be73b3415a5edd0d4a37db07a442ca7a4/grimp-3.19-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:4f449c8a0730e6d104f6a16bed9633dbd903b3117235a52da9bc5e348c3a9764", size = 2455296, upload-time = "2026-11-06T10:40:08.405Z" },
+    { url = "https://files.pythonhosted.org/packages/16/78/d074f86dc0a05ab789df2231305ca898c44302708e6115a09351226d8890/grimp-3.19-cp314-cp314-musllinux_1_2_armv7l.whl", hash = "sha256:6e63cc054ccf873c58ef6b648078b09cb243791f8cb5c9156d0dbdcaf148eebc", size = 2502175, upload-time = "2026-11-06T10:40:10.022Z" },
+    { url = "https://files.pythonhosted.org/packages/85/a3/f85fdacbcf5584cd7b64cd748d70c6c669ff0792c31bfa237113678299d2/grimp-3.19-cp314-cp314-musllinux_1_2_i686.whl", hash = "sha256:0c46113b0f46c62918dccc366ac158ba4f0b095c9d37ee77bf50928c5f4a856a", size = 2530584, upload-time = "2026-11-06T10:40:11.676Z" },
+    { url = "https://files.pythonhosted.org/packages/21/de/a6d8d384ef6bdf1bfc68eb04144c46a8abe12c6c98c2793a06689bc20bba/grimp-3.19-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:826d0490ef493c23c52de3f13056739de6614bb2e7c7489d6bc7e7734f3a74aa", size = 2549088, upload-time = "2026-11-06T10:40:13.315Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/aa/225def7f515305eb1bc9ded74e547d18d25750fb2d0ccec368ef10fbfcaf/grimp-3.19-cp314-cp314-win32.whl", hash = "sha256:f9cf1994b7ceb117da8856de40c31766dbfc68d30a417af790a0b384032892af", size = 1879742, upload-time = "2026-11-06T10:40:15.253Z" },
+    { url = "https://files.pythonhosted.org/packages/46/0d/418070ec589ab673c28d1cb39491055b47d91278535ab5ef0d1ae9cfc918/grimp-3.19-cp314-cp314-win_amd64.whl", hash = "sha256:e65cce8425fbec5029d0a585eb88cba4d29beb00d0d4ae7005000c7344fd4c4a", size = 2009648, upload-time = "2026-11-06T10:40:16.951Z" },
+    { url = "https://files.pythonhosted.org/packages/0f/d2/8cdce7e1372d0098ca8290e11c289e8e74c4c1d5692ebfe29d6012e42fd8/grimp-3.19-cp314-cp314-win_arm64.whl", hash = "sha256:897fb36b3af56887144259c223e8f2befb01e7104522b82a1257b2a272ad1e5c", size = 1926457, upload-time = "2026-11-06T10:40:18.518Z" },
+    { url = "https://files.pythonhosted.org/packages/81/77/556d029b50fb72daf3932b3243864e95e5d35d84779cac342eaab842b7cf/grimp-3.19-cp314-cp314t-macosx_10_12_x86_64.whl", hash = "sha256:d32461f9f142eaca39533ac4ff93affb6845f9a5f1f30b192413cd8cd6f0f79f", size = 2156782, upload-time = "2026-11-06T10:40:20.169Z" },
+    { url = "https://files.pythonhosted.org/packages/4d/5c/67563165f2b76a164d80e66c335040605b79008f48f4fbb4906d9515aaa8/grimp-3.19-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:9bbf4bcf13116c3bf175d892968ebf8a9e8111f77c00f3ab4eaa18aaa87b6fd0", size = 2101409, upload-time = "2026-11-06T10:40:21.805Z" },
+    { url = "https://files.pythonhosted.org/packages/8b/46/dcbf2010bb3cce8b3fb8e5f06bb2ce64abdd35e1385e328ff1724885ca39/grimp-3.19-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:04c84892bbcb91d7c3af5dbd13f9f5d9d4c1aa4de1e3237c6fa5be2703b4da65", size = 2278397, upload-time = "2026-11-06T10:40:23.533Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/de/ce603f3f0b3320e6dc9f4727d916a8cea43e2f7d01ca630bc3a81bd20ef7/grimp-3.19-cp314-cp314t-manylinux2014_armv7l.manylinux_2_17_armv7l.whl", hash = "sha256:19ee88658dc1f7321ded43115640d66261b5f2e21fe58ab5b4140fd5d4f6bc9f", size = 2222022, upload-time = "2026-11-06T10:40:25.507Z" },
+    { url = "https://files.pythonhosted.org/packages/16/f1/f9b335141875b6f5088f0bfdcf7f4a105e8144c02497e347b2e47fa192a0/grimp-3.19-cp314-cp314t-manylinux2014_i686.manylinux_2_17_i686.whl", hash = "sha256:7105eb30e85c1be1bfea4436f44bebc211e326a8ff4e41d69fa31065d91201a3", size = 2368372, upload-time = "2026-11-06T10:40:27.079Z" },
+    { url = "https://files.pythonhosted.org/packages/15/4e/cf6c735454f856dc1b76cd1ff75e6c6bd1faac75714c2818878bb326f7c2/grimp-3.19-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.whl", hash = "sha256:fd6462bed09381d31d002397af6a5b12db244561aa1e27996d5fcd8c3eff1df2", size = 2631230, upload-time = "2026-11-06T10:40:28.66Z" },
+    { url = "https://files.pythonhosted.org/packages/23/68/6b539dfb0f3b1337fa634e8365e8eee2200b47aad339578c05ca8829b4ce/grimp-3.19-cp314-cp314t-manylinux2014_s390x.manylinux_2_17_s390x.whl", hash = "sha256:3e8ac717000732d59bab4d6b2c023ec58d4a01651076dc9a891f996ac5034dc4", size = 2362836, upload-time = "2026-11-06T10:40:30.369Z" },
+    { url = "https://files.pythonhosted.org/packages/c3/7d/c58d92d6a78e32e6216d3661d972030295fe2b1352377dd5d9aab05f0d6f/grimp-3.19-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:8e094cf57f87d991becc8581ad489bb9f978c6cb3ed82b16ae45a5262ceef2ab", size = 2293489, upload-time = "2026-11-06T10:40:32.2Z" },
+    { url = "https://files.pythonhosted.org/packages/da/80/f42aeed900658bb3619819df5e63a909391a5b16b77fdd716ed396c7c29b/grimp-3.19-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:51af06e4c0a0f5abf9d13928d877b0b49832c3cd46fb0dac8549578e31469983", size = 2455976, upload-time = "2026-11-06T10:40:33.795Z" },
+    { url = "https://files.pythonhosted.org/packages/bb/3e/7d61b02f5ed73700bae7b94c91e0ad5abc76e0c4e15b26ef0c027dd77a8a/grimp-3.19-cp314-cp314t-musllinux_1_2_armv7l.whl", hash = "sha256:13af346bee9376faa076122a2bff3c7840794c32b36618836c5dc85fab22e544", size = 2496783, upload-time = "2026-11-06T10:40:35.369Z" },
+    { url = "https://files.pythonhosted.org/packages/a1/65/5484b5eb4928b02223417e2e229528ec31043fa492e0121fa365e4edb4c8/grimp-3.19-cp314-cp314t-musllinux_1_2_i686.whl", hash = "sha256:afa9fbc9b2bd36dc41868b4443812cdfccc5142af9247e5228dda2beebc22b89", size = 2526353, upload-time = "2026-11-06T10:40:37.127Z" },
+    { url = "https://files.pythonhosted.org/packages/70/6c/64f7ab36a6f9da6957ab8d0d24bc54ddc279e21ab953338a7b512a85621b/grimp-3.19-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:3bbb45e22a5f5c082400ba24f7cc50a9c89acc623fbcc5b9a0a4f74a95057ade", size = 2550241, upload-time = "2026-11-06T10:40:39.052Z" },
+    { url = "https://files.pythonhosted.org/packages/f7/9d/4967d07545af1aa1c79e4ea4e07562540d0f7d607f5115d3a187a98072f2/grimp-3.19-cp314-cp314t-win32.whl", hash = "sha256:443b4e0f30ae32ab1d419a82e89104e6192ae2e8e4552d186791eb0c7807a2ba", size = 1877447, upload-time = "2026-11-06T10:40:40.735Z" },
+    { url = "https://files.pythonhosted.org/packages/50/b0/64026f0d40a92c609073d764fa43d33f8aba8803b35ab20ad7cc1fef9216/grimp-3.19-cp314-cp314t-win_amd64.whl", hash = "sha256:11828cfcf7c4d10f9de619dfe948fd96d1806d1e16dbc0ec04a4b644b615b8e1", size = 2006455, upload-time = "2026-11-06T10:40:42.427Z" },
+    { url = "https://files.pythonhosted.org/packages/97/24/d1bbb8042d3a56263c4bf7880e23bf445797c0caeb13eff092bb58e0942d/grimp-3.19-cp314-cp314t-win_arm64.whl", hash = "sha256:8ff0136ffe2c11de8b13501605a39d3ea6a7b25b8b96d1f604595a500e2f4986", size = 1925017, upload-time = "2026-11-06T10:40:44.256Z" },
+    { url = "https://files.pythonhosted.org/packages/02/8b/d38c42743922a1b98235fe989e8e4bb688b8f2707c2e793cf9bc5bfb40fb/grimp-3.19-cp315-cp315-macosx_10_12_x86_64.whl", hash = "sha256:bb40e6cbb2af51ce7dc0a9d288087007e34472e6bb872e9c1799681d53f6fcc2", size = 2156706, upload-time = "2026-11-06T10:40:46.778Z" },
+    { url = "https://files.pythonhosted.org/packages/43/8d/bd0b3a71a79c527ddd2f0ae75620e097d8177125bd4d8e5ded6ab0c08861/grimp-3.19-cp315-cp315-macosx_11_0_arm64.whl", hash = "sha256:b89b16090221aee39b9e23041b37045d0816e665b0bee892dc7538abc3575ab8", size = 2101722, upload-time = "2026-11-06T10:40:48.458Z" },
+    { url = "https://files.pythonhosted.org/packages/21/c4/27985b4d5359bf81b38ab806ebf744a84684580c18fa1eaf63d149daf85b/grimp-3.19-cp315-cp315-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:0a16f6f74ac7590382b4d3b75c405c201912b8fd428b13f89655e370f1864747", size = 2276390, upload-time = "2026-11-06T10:40:50.175Z" },
+    { url = "https://files.pythonhosted.org/packages/db/88/3a66742fe46deb8db9dae82c2d3239fa641d255fbbfb028d1bf1a617cfd6/grimp-3.19-cp315-cp315-manylinux2014_i686.manylinux_2_17_i686.whl", hash = "sha256:221d3e7be13cc803dca91dbe9596a8f4dabfdc0daaad95e12d2707b90173120c", size = 2370155, upload-time = "2026-11-06T10:40:52.185Z" },
+    { url = "https://files.pythonhosted.org/packages/0d/b5/493b5cc2c9920ab2644ac3f39310daa17377315bb327c2e8d763ea947f55/grimp-3.19-cp315-cp315-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:4a9fb0b7dd72687356ab53188c5ccca6dfa535939eb1a66feff3bd91e4883916", size = 2291606, upload-time = "2026-11-06T10:40:53.838Z" },
+    { url = "https://files.pythonhosted.org/packages/de/95/d118fe1d3f9b5814254be88a188b916abd64fa1e4c853e037693e90e77cd/grimp-3.19-cp315-cp315-win32.whl", hash = "sha256:f5463950ddd74828b9f66fc31d3764437cc2e7c60f11b3cf96340056dd785f57", size = 1880073, upload-time = "2026-11-06T10:40:55.543Z" },
+    { url = "https://files.pythonhosted.org/packages/87/33/31557b163ec37049ccfc4015861efcb87bd64a7f478a780f2f13a83933a4/grimp-3.19-cp315-cp315-win_amd64.whl", hash = "sha256:0935b36f178b77a36dfa662f09c63b21b4193babb0517666986f2a451bf342cd", size = 2009785, upload-time = "2026-11-06T10:40:57.191Z" },
+    { url = "https://files.pythonhosted.org/packages/28/1b/5bc239dbe19ca68b200cfaeb46505ca0eca0535a5fcad35554e27f3810e0/grimp-3.19-cp315-cp315-win_arm64.whl", hash = "sha256:205ca44eee94b57cf7ee7ae62b8f98a8cbd495331495b1432f28305a75a0b4f4", size = 1926270, upload-time = "2026-11-06T10:40:58.826Z" },
+    { url = "https://files.pythonhosted.org/packages/32/4f/d0bdfe1a45fcc57e266e330073a2778751f6640f2495774ea48234fb4224/grimp-3.19-cp315-cp315t-macosx_10_12_x86_64.whl", hash = "sha256:2f620ff25cbb4654cdf11e50f2dce1fb4b10ecd5ee1e01807bd89800f998fd4f", size = 2156531, upload-time = "2026-11-06T10:41:00.847Z" },
+    { url = "https://files.pythonhosted.org/packages/ba/cd/a0100a4366940723be9bc81bce66407691047bc46418a52a6a0227426571/grimp-3.19-cp315-cp315t-macosx_11_0_arm64.whl", hash = "sha256:5a8fea619766aa9bd00e8eea053fa8c8662e9bbb745830f7ef1d681482782949", size = 2101153, upload-time = "2026-11-06T10:41:02.762Z" },
+    { url = "https://files.pythonhosted.org/packages/29/ab/bf24b6ef7e6e483af1a66a106fe29c6f7b5de9f04a9c2cd9f53f5a2ba0f7/grimp-3.19-cp315-cp315t-manylinux2014_aarch64.manylinux_2_17_aarch64.whl", hash = "sha256:7941e73d6431bba4f210412687855d1224981e39b35407566ffc44e497d3e7e1", size = 2278648, upload-time = "2026-11-06T10:41:04.416Z" },
+    { url = "https://files.pythonhosted.org/packages/5e/96/1ad54a439651bbf225e4b169f7f45869d7291335832a49c18cd9aeaf97d6/grimp-3.19-cp315-cp315t-manylinux2014_i686.manylinux_2_17_i686.whl", hash = "sha256:80dd14297e48a0b90b07a3f04fcdfc6f7a680dca2fea3530937b1729378b0874", size = 2368594, upload-time = "2026-11-06T10:41:06.757Z" },
+    { url = "https://files.pythonhosted.org/packages/3f/33/88ff9b779be24ffeb896582f6930669b056d4ba7cda5f50d73b24761573d/grimp-3.19-cp315-cp315t-manylinux2014_x86_64.manylinux_2_17_x86_64.whl", hash = "sha256:2ef1f646d10fd5d3cd5e1f17c76e0c21e5131a75c142002e0c5ea3fb8f31b494", size = 2292383, upload-time = "2026-11-06T10:41:08.358Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/52/097f3a52b34af306a427f48f06201ebba7d556aff1e7ed92e3160d32b6cd/grimp-3.19-cp315-cp315t-win32.whl", hash = "sha256:9ca984ae33b2899d6a32bd2105c00ca6af8404e56ff08cf6172eba82326843df", size = 1877842, upload-time = "2026-11-06T10:41:09.897Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/e1/90e02a8bfaaa097e347dbfa7a230054e48df6eada67ad7af863af2c2de01/grimp-3.19-cp315-cp315t-win_amd64.whl", hash = "sha256:b3ecf6e0d177dbe1319b3a1317eb3ae08cb4ca2f033316a2dcc6646acbf7349c", size = 2006815, upload-time = "2026-11-06T10:41:11.914Z" },
+    { url = "https://files.pythonhosted.org/packages/93/a8/ccad735834d66df8403540228d6938fa0c692e6ff2e5c59e0e86013be29a/grimp-3.19-cp315-cp315t-win_arm64.whl", hash = "sha256:8fa36b50803573bcba871a756718981ad579ac07a93c06519ae81b81c71e6d9f", size = 1925196, upload-time = "2026-11-06T10:41:13.763Z" },
+]
+
 [[package]]
 name = "h11"
 version = "0.16.0"
@@ -88,6 +563,31 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/04/4b/29cac41a4d98d144bf5f6d33995617b185d14b22401f75ca86f384e87ff1/h11-0.16.0-py3-none-any.whl", hash = "sha256:63cf8bbe7522de3bf65932fda1d9c2772064ffb3dae62d55932da54b31cb6c86", size = 37515, upload-time = "2025-04-24T03:35:24.344Z" },
 ]
 
+[[package]]
+name = "http-message-signatures"
+version = "3.0.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "cryptography" },
+    { name = "http-sf" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/77/c7/eecd8e93818a29f6ceb02145018ee7c36469da543af7410981d2e9d40ee5/http_message_signatures-3.0.0.tar.gz", hash = "sha256:fcb26b157462483b4d6b264df8c9c1a796439a78a3d42ad412bcbf507f39db01", size = 115968, upload-time = "2026-10-26T02:17:36.249Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/14/e7/fc0c602d1e921b13e8451a9287289594871ca3c448f0c4d9bf0a9bd3b0b2/http_message_signatures-3.0.0-py3-none-any.whl", hash = "sha256:c289966e1b2950517cd57aed166be5e981de96f0cd29f69173f09ac547a8552a", size = 53460, upload-time = "2026-10-26T02:17:34.929Z" },
+]
+
+[[package]]
+name = "http-sf"
+version = "1.5.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "typing-extensions" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/44/d1/af2d7665a9cb295f95a4125826a45443bd6f554946d1ca9876cf3ef1dc3b/http_sf-1.5.0.tar.gz", hash = "sha256:b54cfa55f428dd7cb1cfcc6fbd5020f967060df136ffa37cab5b9798f647612f", size = 55553, upload-time = "2026-10-23T01:43:58.992Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/f4/4a/5a1d3b0fcb58cbd827a968f69d6139c1af419dd008f2c4caf8a8ab78b7bd/http_sf-1.5.0-py3-none-any.whl", hash = "sha256:031282bd376549b04fcaa397d9ef351acdc5bd383435cccd1d8ea17b1661c80e", size = 27696, upload-time = "2026-10-23T01:43:57.816Z" },
+]
+
 [[package]]
 name = "httpcore"
 version = "1.0.9"
@@ -136,32 +636,65 @@ sandbox = [
     { name = "fastapi" },
     { name = "uvicorn" },
 ]
+wba = [
+    { name = "cryptography" },
+    { name = "http-message-signatures" },
+    { name = "http-sf" },
+    { name = "httpx" },
+    { name = "idna" },
+    { name = "joserfc" },
+]
 
 [package.dev-dependencies]
 dev = [
+    { name = "ast-grep-cli" },
+    { name = "cryptography" },
     { name = "fastapi" },
+    { name = "http-message-signatures" },
+    { name = "http-sf" },
     { name = "httpx" },
+    { name = "idna" },
+    { name = "import-linter" },
+    { name = "joserfc" },
+    { name = "mypy" },
     { name = "pytest" },
+    { name = "pytest-cov" },
     { name = "ruff" },
     { name = "uvicorn" },
 ]
 
 [package.metadata]
 requires-dist = [
+    { name = "cryptography", marker = "extra == 'wba'", specifier = ">=45.0.1" },
     { name = "fastapi", marker = "extra == 'harness'", specifier = ">=0.110" },
     { name = "fastapi", marker = "extra == 'sandbox'", specifier = ">=0.110" },
+    { name = "http-message-signatures", marker = "extra == 'wba'", specifier = "==3.0.0" },
+    { name = "http-sf", marker = "extra == 'wba'", specifier = ">=1.5,<2" },
     { name = "httpx", marker = "extra == 'client'", specifier = ">=0.27" },
     { name = "httpx", marker = "extra == 'harness'", specifier = ">=0.27" },
+    { name = "httpx", marker = "extra == 'wba'", specifier = ">=0.28.1,<1" },
+    { name = "idna", marker = "extra == 'wba'", specifier = ">=3.7,<4" },
+    { name = "joserfc", marker = "extra == 'wba'", specifier = ">=1.7.5,<2" },
     { name = "pydantic", specifier = ">=2" },
     { name = "uvicorn", marker = "extra == 'sandbox'", specifier = ">=0.29" },
 ]
-provides-extras = ["client", "sandbox", "harness"]
+provides-extras = ["client", "sandbox", "harness", "wba"]
 
 [package.metadata.requires-dev]
 dev = [
+    { name = "ast-grep-cli", specifier = "==0.45.3" },
+    { name = "cryptography", specifier = ">=45.0.1" },
     { name = "fastapi", specifier = ">=0.110" },
+    { name = "http-message-signatures", specifier = "==3.0.0" },
+    { name = "http-sf", specifier = ">=1.5,<2" },
     { name = "httpx", specifier = ">=0.27" },
+    { name = "httpx", specifier = ">=0.28.1,<1" },
+    { name = "idna", specifier = ">=3.7,<4" },
+    { name = "import-linter", specifier = ">=2.1" },
+    { name = "joserfc", specifier = ">=1.7.5,<2" },
+    { name = "mypy", specifier = ">=1.18.2" },
     { name = "pytest" },
+    { name = "pytest-cov", specifier = ">=6.2.1" },
     { name = "ruff" },
     { name = "uvicorn", specifier = ">=0.29" },
 ]
@@ -175,6 +708,20 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/1e/5e/d4e9f1a599fb8e573b7b87160658329fbf28d19eac2718f51fc3def3aa5a/idna-3.18-py3-none-any.whl", hash = "sha256:7f952cbe720b688055e3f87de14f5c3e5fdaa8bc3928985c4077ca689de849a2", size = 65455, upload-time = "2026-06-02T14:34:06.319Z" },
 ]
 
+[[package]]
+name = "import-linter"
+version = "2.16"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "click" },
+    { name = "grimp" },
+    { name = "rich" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/f0/70/ac97afe41a04239a60c9d92fbe593294bf6501309d728af4a400e569d786/import_linter-2.16.tar.gz", hash = "sha256:c5bd0d38bdef46c7251120266b3bf72662bc8cd989a8fe461499936e12e8c6fa", size = 1405978, upload-time = "2026-11-06T13:48:21.617Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/e1/f9/0f8a5a9a95c2b3b7e87e7406a2941a5620aeaacc4207155d5010263dabb6/import_linter-2.16-py3-none-any.whl", hash = "sha256:e775602e9214ab3933fc7d2162278ea1f11dd9229c914735c1bda43b94619565", size = 644477, upload-time = "2026-11-06T13:48:20.099Z" },
+]
+
 [[package]]
 name = "iniconfig"
 version = "2.3.0"
@@ -184,6 +731,224 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/cb/b1/3846dd7f199d53cb17f49cba7e651e9ce294d8497c8c150530ed11865bb8/iniconfig-2.3.0-py3-none-any.whl", hash = "sha256:f631c04d2c48c52b84d0d0549c99ff3859c98df65b3101406327ecc7d53fbf12", size = 7484, upload-time = "2025-10-18T21:55:41.639Z" },
 ]
 
+[[package]]
+name = "joserfc"
+version = "1.8.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "cryptography" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/74/31/5c3f27e82c92a7bbe1f028033ff19e0251540395c9be244c01a50de42bdb/joserfc-1.8.0.tar.gz", hash = "sha256:cbf03cb2c6db8cc5289f1ef8718842e53dba244b4c0de5fefa0c0eaee4bde8db", size = 241023, upload-time = "2026-11-03T10:45:57.948Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/5e/7e/7ffaae13415e8f51c8e8d5d1845f2de7a27ebf2717e97a38d7e7446d6030/joserfc-1.8.0-py3-none-any.whl", hash = "sha256:176b836ac7ed9a46a88629e24076314b475f33a75d0bad7f26146e572eed7c79", size = 73147, upload-time = "2026-11-03T10:45:56.531Z" },
+]
+
+[[package]]
+name = "librt"
+version = "0.16.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/04/f5/9dc696772d241814bacac7880bac32f2930b5a6ebc1f85317b83161a011c/librt-0.16.0.tar.gz", hash = "sha256:ac38d6d8d66bf3d744148dbbc0b8e193e195a51e364ed55e224631f5721891fc", size = 219839, upload-time = "2026-09-29T00:55:32.891Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/ba/0e/b04fd2d76b6a78a02286938251b2c119fb36ddece92c76cb4886ef7d44b8/librt-0.16.0-cp311-cp311-macosx_10_9_x86_64.whl", hash = "sha256:fe4372c52d4849096c6cc1cda2817d293ec51440c890474ed59ef38d46556f18", size = 148058, upload-time = "2026-09-29T00:44:40.903Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/fc/e1ed24aadb32d38603c0c07f579d739eb4d90e64e90d525b024e4a999b4d/librt-0.16.0-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:c72c5295a84bd249526da9bdca38f2e176d15c31c13bb0063c5053f4ca023421", size = 153073, upload-time = "2026-09-29T00:44:42.165Z" },
+    { url = "https://files.pythonhosted.org/packages/be/38/133ab655409420e0c34a9a9836a7f4e5ae75fba758d7fe177099130d58ba/librt-0.16.0-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:be56ba9c884143495b517f23fe794ae367d58cd89ea0fdd6d437e3c024a87f9f", size = 493052, upload-time = "2026-09-29T00:44:44.043Z" },
+    { url = "https://files.pythonhosted.org/packages/94/42/aaa663bc9421f5bf7bbbe9d3316d7219749698ec7688ac3b519770a89c04/librt-0.16.0-cp311-cp311-manylinux2014_i686.manylinux_2_17_i686.manylinux_2_28_i686.whl", hash = "sha256:ef46c1a29ffb8c72e882e22618ec618778eacd0578fb22c6e7cf9c11d15f357b", size = 485506, upload-time = "2026-09-29T00:44:45.479Z" },
+    { url = "https://files.pythonhosted.org/packages/7b/59/83a6eb5087ba8b45b083859e2085256963e06d4c2531944cdd962670bfb5/librt-0.16.0-cp311-cp311-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:d3c94211ee0c4f8d649ec06b7c115c0ec4eadb873a0e3154ca15cef3f814b071", size = 498708, upload-time = "2026-09-29T00:44:46.916Z" },
+    { url = "https://files.pythonhosted.org/packages/a0/e4/15a8d62b2bc12935080ec7277e2e0b9b233047781eb784a51d3e25af669a/librt-0.16.0-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:94aed6a8308818b91677957d1bd03188869cd7aeb23c5dba7912a6c0402f7602", size = 515981, upload-time = "2026-09-29T00:44:48.316Z" },
+    { url = "https://files.pythonhosted.org/packages/46/4f/287cc282ac5dd815204c0779e79401bb0a568c3a1335fb319bf0838fb566/librt-0.16.0-cp311-cp311-manylinux_2_34_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:349c0bcb87ebd07481b6ff781e25cdc699723dbe2212e57dabb27f7a13b7b87d", size = 508670, upload-time = "2026-09-29T00:44:49.726Z" },
+    { url = "https://files.pythonhosted.org/packages/bf/5b/ab7292add898ade0d2b5b75d32a923aae315861671aa5c39f5491309f7ae/librt-0.16.0-cp311-cp311-musllinux_1_2_aarch64.whl", hash = "sha256:001bfd59a7d45b17e3e75f2a8c6405280b35e7b84471792778e718c4f368950e", size = 530393, upload-time = "2026-09-29T00:44:51.356Z" },
+    { url = "https://files.pythonhosted.org/packages/7a/9e/8e6bcf027d4bcbc16a4e864b3d158a1d3e5f55ffa53af0238020cad89271/librt-0.16.0-cp311-cp311-musllinux_1_2_i686.whl", hash = "sha256:28e038895b998d7a0c7798922ce8a1dc157675df5cf1c9ef0aca809ed804b7a1", size = 534302, upload-time = "2026-09-29T00:44:52.893Z" },
+    { url = "https://files.pythonhosted.org/packages/96/a4/8c5ab4f3b3a8e905ff8305d76976a2e666f52fe049edd398aed2402beb36/librt-0.16.0-cp311-cp311-musllinux_1_2_ppc64le.whl", hash = "sha256:0dbe4096a7ecc00fa835d24510ad8545a4efef738dac96e0e63516783ccde905", size = 536150, upload-time = "2026-09-29T00:44:54.421Z" },
+    { url = "https://files.pythonhosted.org/packages/ea/5e/7c4bc267e3cd4b8bd288de9f62d61fff203829c9cc649ea2aa12e9218cf0/librt-0.16.0-cp311-cp311-musllinux_1_2_riscv64.whl", hash = "sha256:5cd5b092441053364af968ea12084692cb9d4a22f3ce9524e377880bf028761e", size = 514316, upload-time = "2026-09-29T00:44:55.998Z" },
+    { url = "https://files.pythonhosted.org/packages/e0/75/c8bc6b50f43c73819334233f5a3259c81216742cef56d2140c3dd377c3f0/librt-0.16.0-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:3ddeb3c9dedb461bb457c6c7d9aa7fbf35329da313d1a7543d00c8d0f3473c96", size = 557731, upload-time = "2026-09-29T00:44:57.581Z" },
+    { url = "https://files.pythonhosted.org/packages/93/fb/e241f91bc8de6c7ac1c6a20ea6dd381bc52312b44d711ffcd97140db1e57/librt-0.16.0-cp311-cp311-win32.whl", hash = "sha256:e05108e0849966f53a8d2d3112a7af881d0efaa479bc735bba91108f9f2350a7", size = 104922, upload-time = "2026-09-29T00:44:59.078Z" },
+    { url = "https://files.pythonhosted.org/packages/d1/38/c892383d2bb1a6a80b2ec8ede84970a265a792c56614a06282bf3008517c/librt-0.16.0-cp311-cp311-win_amd64.whl", hash = "sha256:5f49cff01bd608ef7d97104cb035c75455e79c2d70bf4a506cf773338ac1860d", size = 125093, upload-time = "2026-09-29T00:49:01.621Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/56/8bbde1ed0b21480163617648f638fdaec9374cf5e9c846ebcee34ec02a42/librt-0.16.0-cp311-cp311-win_arm64.whl", hash = "sha256:1d28ae980ae2218f9c5b95d191e947296f918c9bf0b400d467a9430275bbe678", size = 115910, upload-time = "2026-09-29T00:52:40.131Z" },
+    { url = "https://files.pythonhosted.org/packages/ad/76/bbdaeb87b7c47b5c7343e90222b9bfa4e4a8a83f647e02933ad0129225b1/librt-0.16.0-cp312-cp312-macosx_10_13_x86_64.whl", hash = "sha256:fe52bf4641069e7978a14253b036cb9002def1926317e710f2e249f8a8c47742", size = 151028, upload-time = "2026-09-29T00:52:41.508Z" },
+    { url = "https://files.pythonhosted.org/packages/fd/0c/ab8ed3dab0085931aec4a792c7eaac8dc6c5ff4691fda3a5360d9d8a9cd2/librt-0.16.0-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:5bcc2c4726ced915b00de0c9856a4eeabfb3fddb93e10e0b8f735b7709358b6d", size = 155283, upload-time = "2026-09-29T00:52:42.873Z" },
+    { url = "https://files.pythonhosted.org/packages/eb/36/494e79d460c80c1f030661e8287c9eca5e1ad652dc2b2180b6cd42abce0a/librt-0.16.0-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:ff7baa55f8e7c69851419e50a666015d02a74198716fd45c0125a2112e0a389f", size = 503185, upload-time = "2026-09-29T00:52:44.638Z" },
+    { url = "https://files.pythonhosted.org/packages/9b/34/a8464038dd9db6e4381fa2b6eb73dc9a50888d77102c4c139304ac35cddc/librt-0.16.0-cp312-cp312-manylinux2014_i686.manylinux_2_17_i686.manylinux_2_28_i686.whl", hash = "sha256:b95d5d92ab83d39e760a52091bb1baba664f3a2351e39b1e16801e5747c2f0e9", size = 496738, upload-time = "2026-09-29T00:52:46.441Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/53/e0e5e334ef0c6ed27039d323819368b9ef6712be87d55ee2bf9799398afd/librt-0.16.0-cp312-cp312-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:b6d085d70bce51d43c5c7c36d63490770180d8779e71c49305c87b4213918de7", size = 513818, upload-time = "2026-09-29T00:52:48.068Z" },
+    { url = "https://files.pythonhosted.org/packages/ad/f7/7ce72cbf19d0addd05090b339152fd0548a02562c2866a603e6e3b3da2df/librt-0.16.0-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:36e53948e99bbe3ffea257124cfcae1cfb01831555c9a9c903c9f9a72db7fd07", size = 531952, upload-time = "2026-09-29T00:52:49.816Z" },
+    { url = "https://files.pythonhosted.org/packages/83/22/0b1bcb6a8e723c8b4fd60dfc8ae8ec6461c54073fbc8685efeb8d900d407/librt-0.16.0-cp312-cp312-manylinux_2_34_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:54d11f726aae9df5a6ffbbf0a03a52449bbac84a53ef03669cb41cdfd4ae41bf", size = 524465, upload-time = "2026-09-29T00:52:51.354Z" },
+    { url = "https://files.pythonhosted.org/packages/64/2e/e9c23b8b9df1813da1be205deca9606beb7ddd033972246cd426d05374a0/librt-0.16.0-cp312-cp312-musllinux_1_2_aarch64.whl", hash = "sha256:4323193ac0cd025f85af531df8ba91bf24d1973b401697347a6282e8fd3fcf5e", size = 543191, upload-time = "2026-09-29T00:52:53.284Z" },
+    { url = "https://files.pythonhosted.org/packages/bc/e5/6a8b21b342c03ed7e230fa3afbfd2edc58e6e87ef1f0d11fa2b9a748c252/librt-0.16.0-cp312-cp312-musllinux_1_2_i686.whl", hash = "sha256:e42f8e098b9c5396fefa05fb1cc7e33b0e08fc51da106b5de4a45fd22aac6743", size = 546979, upload-time = "2026-09-29T00:52:54.932Z" },
+    { url = "https://files.pythonhosted.org/packages/84/9e/b5129023eced1be01e01c22757f53be551d463b1bb7264f787927404c1d6/librt-0.16.0-cp312-cp312-musllinux_1_2_ppc64le.whl", hash = "sha256:39ec1d5a14e37baf1450a6cabf03fe552340808bf1ad9d71824ab90117716459", size = 555317, upload-time = "2026-09-29T00:52:56.869Z" },
+    { url = "https://files.pythonhosted.org/packages/71/89/28bba5938c725fe91f06bf93f7fa6c6b150229df53a87b454b0d5c2a796e/librt-0.16.0-cp312-cp312-musllinux_1_2_riscv64.whl", hash = "sha256:d1aabe3925cbb4a08d15b7b20ba4011b53019da0c4173a25155139b7b1baed65", size = 535846, upload-time = "2026-09-29T00:52:58.475Z" },
+    { url = "https://files.pythonhosted.org/packages/22/92/63773026614f888c5d4e370e395ce42ca604b89f70b3acdfedbf94851b80/librt-0.16.0-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:300c3ffdc459f4a779a8411ecb188e3ac0b1ff3a3a7b099642555dedae06c69b", size = 573700, upload-time = "2026-09-29T00:53:00.127Z" },
+    { url = "https://files.pythonhosted.org/packages/66/8f/347d4677eefb57cd9f8e01d95a1dcee9a91b4e44e664173c32ff6f3752e5/librt-0.16.0-cp312-cp312-win32.whl", hash = "sha256:c17194318e4c0c0348b36f36c2ec7534436fe0a4c15582403162a4f08c80797a", size = 106158, upload-time = "2026-09-29T00:53:02.031Z" },
+    { url = "https://files.pythonhosted.org/packages/f0/2c/5193dc81127cd5ddfad031391b046bf32dda219b38463ab872407ca30646/librt-0.16.0-cp312-cp312-win_amd64.whl", hash = "sha256:25a58a19ea8d83b68209f04912df765e9260635ef77646542ed4b4abe6bc7940", size = 126176, upload-time = "2026-09-29T00:53:03.445Z" },
+    { url = "https://files.pythonhosted.org/packages/ff/3d/9668a400c8dd81d162eba38b33fa49fa6205f1a64493570a13fbb815c3ee/librt-0.16.0-cp312-cp312-win_arm64.whl", hash = "sha256:f7be7cf555bc30ec12622e9447299cc4a9b8ff307548b634794353db0c2065dc", size = 116572, upload-time = "2026-09-29T00:53:04.815Z" },
+    { url = "https://files.pythonhosted.org/packages/46/cd/ae5e0e9dba45d1399aa04a5395bcc0bead40d9fa06dc903634a7b4d7473d/librt-0.16.0-cp313-cp313-macosx_10_13_x86_64.whl", hash = "sha256:c5e6144e68b577f157519f2ba88ca20e3ed61c29b00e5cdfa76cd2d45acf059a", size = 151036, upload-time = "2026-09-29T00:53:06.284Z" },
+    { url = "https://files.pythonhosted.org/packages/41/5a/48a16e323c5f9447a94cce7b59babf60fa04e62c3365ecf060c77ed8b320/librt-0.16.0-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:33f41443a1f4e1f099331b3d8120e409fbff84b9760bc1cc9ea496f37ddaa5cc", size = 155211, upload-time = "2026-09-29T00:53:07.72Z" },
+    { url = "https://files.pythonhosted.org/packages/3f/29/0f59299eb4251a409b2e690ad4b7d9f8a676db829d7817ec961f32b44f7e/librt-0.16.0-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:7e510b7770bee609617a3374a96548eb114cae048023e3f049ee449e7ff2db32", size = 502587, upload-time = "2026-09-29T00:53:09.191Z" },
+    { url = "https://files.pythonhosted.org/packages/de/ba/d6fb4ef8d1537c396079d72289f16be7cd35a366e5065c51253fea2760b6/librt-0.16.0-cp313-cp313-manylinux2014_i686.manylinux_2_17_i686.manylinux_2_28_i686.whl", hash = "sha256:efc49c462d4516b8a58b00b490078fa64689fd1fe66970cc190131d7afb8027e", size = 496146, upload-time = "2026-09-29T00:53:11.016Z" },
+    { url = "https://files.pythonhosted.org/packages/52/fc/8c50dd4d7cc97c0ee8f252c8a3104980f234391cf1519b554e8b9de08b60/librt-0.16.0-cp313-cp313-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:92caf82ebef5e12d21c72242b70d1e92536f1711cf2a727a4c276de4b4469087", size = 513336, upload-time = "2026-09-29T00:53:12.655Z" },
+    { url = "https://files.pythonhosted.org/packages/a9/59/16c409c56f708eda2db9a0553662845d45e3871c77d70a240dae3f3bdc56/librt-0.16.0-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:17bac7f7a16b328fff77e440287693eb017abde913595b5827ebccbc21ecd8a6", size = 531689, upload-time = "2026-09-29T00:53:14.39Z" },
+    { url = "https://files.pythonhosted.org/packages/88/82/d34772a6c29d1446dcca6e64d74062efd508523ab351aa16625a4689d5cc/librt-0.16.0-cp313-cp313-manylinux_2_34_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:5b976054553670829985ed767feb78fb6bcede0175327c4844dd5c281c1be659", size = 524537, upload-time = "2026-09-29T00:53:16.064Z" },
+    { url = "https://files.pythonhosted.org/packages/77/8f/24c5631313746131ccee53bc91fdc8374f9cf25e0082a1fee9c93bb98acc/librt-0.16.0-cp313-cp313-musllinux_1_2_aarch64.whl", hash = "sha256:0058f9d68721094105917254c72ac0569117bb7b13b9769cf45d26d89f9d21cd", size = 543231, upload-time = "2026-09-29T00:53:17.939Z" },
+    { url = "https://files.pythonhosted.org/packages/f2/cb/5f8e0d41dbd8b499c2265e939c31acc9ba59845565bf99539ad1c06aebcf/librt-0.16.0-cp313-cp313-musllinux_1_2_i686.whl", hash = "sha256:30b7beaf3f4487b7d8adef1f158b49067cb4d5a19fa7a3bf31a4e7a820e435c5", size = 546499, upload-time = "2026-09-29T00:53:19.666Z" },
+    { url = "https://files.pythonhosted.org/packages/be/61/063052de441d1385f59cea4223f184bf9e5d125de1ae3239b490aa1e486e/librt-0.16.0-cp313-cp313-musllinux_1_2_ppc64le.whl", hash = "sha256:468df902df016a06eb0e40b0747dc8d14e47d7a38b18b63b1fb167d85cb94d63", size = 555261, upload-time = "2026-09-29T00:53:21.292Z" },
+    { url = "https://files.pythonhosted.org/packages/14/11/a2ada0529372268d6401afa9d457a095b68cd7753532b6f7f33049a19b43/librt-0.16.0-cp313-cp313-musllinux_1_2_riscv64.whl", hash = "sha256:aea7b1f2b125dad5de85f049136651bff256c883c65e6b9209b2da0a1ac3cdef", size = 536029, upload-time = "2026-09-29T00:53:23.07Z" },
+    { url = "https://files.pythonhosted.org/packages/23/9d/5bb6d38853382986dca702fc7e06c8256d30f5fa0676d882773b744610dc/librt-0.16.0-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:a8afb6557920860b7a3a596eb804cf37e09e7cf8a803db2478c202acc72d8c2e", size = 573748, upload-time = "2026-09-29T00:53:24.696Z" },
+    { url = "https://files.pythonhosted.org/packages/99/f6/0025cde35ff7f607684dc775a2b2d732cce2561cec050a6ee1fb2e1fc6fe/librt-0.16.0-cp313-cp313-pyemscripten_2025_0_wasm32.whl", hash = "sha256:77c7a2b4fe2c1369e0d5aa1cade26740a7b14be32fbc9a5535d617d20065c39d", size = 79861, upload-time = "2026-09-29T00:53:26.089Z" },
+    { url = "https://files.pythonhosted.org/packages/93/93/303b8592909bd583f83f02818ffbea3f7647ca1e22b1cd5465d04b8145fe/librt-0.16.0-cp313-cp313-win32.whl", hash = "sha256:02d89c813d5ff74b17df72d3a34819d132cd168e56b81bf755b809bd9e46b8c4", size = 106236, upload-time = "2026-09-29T00:53:27.43Z" },
+    { url = "https://files.pythonhosted.org/packages/cf/24/80bbb463c60ed18e29cb26aba386ddb76609580e4e7160710e550587018c/librt-0.16.0-cp313-cp313-win_amd64.whl", hash = "sha256:14ed6ebe3e4f85f326d7920011ad30ff49ed9334e62cf88caef9ba973d9e3a92", size = 126180, upload-time = "2026-09-29T00:53:28.7Z" },
+    { url = "https://files.pythonhosted.org/packages/43/80/b1a6fbdd7da825cdd55c71aa81eb6cfa82c513c360774152eacb50b4a771/librt-0.16.0-cp313-cp313-win_arm64.whl", hash = "sha256:83d4041a3d9b2fd053a8a4e1f22878b3e5833e2712956382d5c048d791454e91", size = 116557, upload-time = "2026-09-29T00:53:30.012Z" },
+    { url = "https://files.pythonhosted.org/packages/1e/93/9e0cf7da129a93c3dc7f45bc3cd4a660f2aaa995aa8a6f95c2583ef41239/librt-0.16.0-cp314-cp314-macosx_10_15_x86_64.whl", hash = "sha256:931a0bb0fcac88f263e269e46eb30ba8e21402cd3c62ca40cb97034c0693fab1", size = 149844, upload-time = "2026-09-29T00:53:31.391Z" },
+    { url = "https://files.pythonhosted.org/packages/8f/26/8a90d2a8f2b2e471bb486b7aec117b8ae622715ed6c39853aec48ea20073/librt-0.16.0-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:1bc17e54e5305f8d40b7ca203671ff5a9e59c1d0f8ea0f625dcca53a3984de11", size = 154111, upload-time = "2026-09-29T00:53:32.718Z" },
+    { url = "https://files.pythonhosted.org/packages/35/ce/67abb46258da4d3e42ff5b141db6f38c59357bef84c7979f183b22f924f1/librt-0.16.0-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:877698bf6bca5721d8be345f2fe09778e40ecadea8b58c73075f2b1a53666bf2", size = 494234, upload-time = "2026-09-29T00:53:34.466Z" },
+    { url = "https://files.pythonhosted.org/packages/12/f9/ea7162414a16f8f1bbd3b493ad6d22b926c5471916e078350bdbca8c4e5f/librt-0.16.0-cp314-cp314-manylinux2014_i686.manylinux_2_17_i686.manylinux_2_28_i686.whl", hash = "sha256:5981c011b306781ce561e18e14230a14524a3d8109b97553666c942c18f31a96", size = 491173, upload-time = "2026-09-29T00:53:36.124Z" },
+    { url = "https://files.pythonhosted.org/packages/b1/09/9b3e869060dd33f9989b80ba4fea306f6db8cecefcdfe6d7346ef0603f65/librt-0.16.0-cp314-cp314-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:afced3dfc17cd805ecf7a3d77996a71cf5f2c75aa66eb0c21a9930f4fc992f86", size = 505547, upload-time = "2026-09-29T00:53:37.686Z" },
+    { url = "https://files.pythonhosted.org/packages/50/07/79007d2165f649ea93e08c0962d1d62c70af9cde77965255095bf9d96f9a/librt-0.16.0-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:ca8052401c55d7511dda6760719fda7618067e83535d7d0010096d216c34b667", size = 523057, upload-time = "2026-09-29T00:53:39.301Z" },
+    { url = "https://files.pythonhosted.org/packages/61/0c/8fbaff66d0ba376d8864653f5acce1569bae27e89648671f26f7eca67ab8/librt-0.16.0-cp314-cp314-manylinux_2_34_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:1e511762a074005bb0aa569166779834e75e438370226930d0ce1866d4b6a33b", size = 515158, upload-time = "2026-09-29T00:53:41.012Z" },
+    { url = "https://files.pythonhosted.org/packages/df/2e/23ff0dece76f07a4124413a57682efa0bbeb5765ac0122bc0955513f82ca/librt-0.16.0-cp314-cp314-musllinux_1_2_aarch64.whl", hash = "sha256:f1e8591bd8a5a628cd7f07954c6a1592359a878bf032957a8e9057a41d644311", size = 534183, upload-time = "2026-09-29T00:53:42.451Z" },
+    { url = "https://files.pythonhosted.org/packages/26/c4/e11dea21d9a29486eba78887380374189d472734fa32cc50cb37ca44d3d0/librt-0.16.0-cp314-cp314-musllinux_1_2_i686.whl", hash = "sha256:a4aaefb4ba6c07e1aeebb2795c8958148f1d6f9af3b555b53d23d766edb6d67a", size = 540663, upload-time = "2026-09-29T00:53:44.272Z" },
+    { url = "https://files.pythonhosted.org/packages/44/75/e873ae158a8b7f5359be33e7fd6c1fbe02d9a78a3e89a77de6b0e837f476/librt-0.16.0-cp314-cp314-musllinux_1_2_ppc64le.whl", hash = "sha256:d92db7a0f6aee44f1baee94750457e8d2d1c6ccea41842de6268d34e8dc7eddd", size = 545908, upload-time = "2026-09-29T00:53:45.812Z" },
+    { url = "https://files.pythonhosted.org/packages/ba/36/8939d3f6a93e11bd9592e6fe28d2b44f1c2dc4bed6e22e72359a91e18ffb/librt-0.16.0-cp314-cp314-musllinux_1_2_riscv64.whl", hash = "sha256:378dfaffb38e59c24a87cde5713cd865d51ff7383fa12947f3907f306ea1ca55", size = 523302, upload-time = "2026-09-29T00:53:47.596Z" },
+    { url = "https://files.pythonhosted.org/packages/71/14/35309f44a077f0f42ade0e2e7cd88c0cea760c661af205c01ea90d3c0e1f/librt-0.16.0-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:3e0c39bdc85370422e8b637be76eb1fd07d30967551b03e62267dd156f553152", size = 565911, upload-time = "2026-09-29T00:53:49.278Z" },
+    { url = "https://files.pythonhosted.org/packages/78/0c/df6255b94967f3159ebc46f08d8e783c12da6ee269ddb74b2efed63c640c/librt-0.16.0-cp314-cp314-pyemscripten_2026_0_wasm32.whl", hash = "sha256:1b384b90ab79a7bc30b566895809a636e0666f21f3cf12b54823d025b7e83839", size = 79119, upload-time = "2026-09-29T00:53:50.938Z" },
+    { url = "https://files.pythonhosted.org/packages/6b/44/d30d5a5461378c9d33f36736c6791c3b4c4ba4b1ffe0da7350aedcb2c9a0/librt-0.16.0-cp314-cp314-win32.whl", hash = "sha256:52327da75a94012e7f932f913d20d3876bed3c102be00e6c3e8600ff7bdd58a7", size = 100140, upload-time = "2026-09-29T00:53:52.205Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/98/769712f356a1e897df3581bb0c3100375d054a000de26099360ea65b5111/librt-0.16.0-cp314-cp314-win_amd64.whl", hash = "sha256:3f0b8114c44b2ac06ff5dacd08e07e8e807ff4f46083f2a1602685122559be41", size = 120464, upload-time = "2026-09-29T00:53:53.495Z" },
+    { url = "https://files.pythonhosted.org/packages/bf/d3/ae2abccc8bdc8b063c1613a77686e17b74e9d3d60cfe6f12c63fa2821b9f/librt-0.16.0-cp314-cp314-win_arm64.whl", hash = "sha256:8caf96a4ef8fb27d0ac0d1ad8337d26a240acd4a02fe4345d0a8f264753e8f99", size = 110889, upload-time = "2026-09-29T00:53:54.817Z" },
+    { url = "https://files.pythonhosted.org/packages/e4/26/0737d4be058dd6376eade7dd8b380d4b869b6394cee929393a5a431c45bb/librt-0.16.0-cp314-cp314t-macosx_10_15_x86_64.whl", hash = "sha256:953107e2f68d0f3512c48f898b0dbf0ce5cc52bba0f318d847c985dc555ee4cc", size = 159838, upload-time = "2026-09-29T00:53:56.22Z" },
+    { url = "https://files.pythonhosted.org/packages/01/96/9bc96531d7c620e9949af904470f02e3fa8f35129ab8e8f281c51eaa3788/librt-0.16.0-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:ad37d5b9abd49c9a655dcda7ea52a8a752884062ef1ee71ae17c2f2a0f81fe6a", size = 162018, upload-time = "2026-09-29T00:53:57.532Z" },
+    { url = "https://files.pythonhosted.org/packages/0e/fa/b0289dcb186eb3f97221ba00da5f4bd3ba7fa5e99752d48aa8d336615334/librt-0.16.0-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:2c4aa329c17bd1aaea4f6e89335d8ccd494b3a5830b6654462273e50e11023f0", size = 703983, upload-time = "2026-09-29T00:53:59.024Z" },
+    { url = "https://files.pythonhosted.org/packages/d9/ab/05ebbbde7530fc5eeb58fbd1581522a9f64f132fa703c4c595eed6e14760/librt-0.16.0-cp314-cp314t-manylinux2014_i686.manylinux_2_17_i686.manylinux_2_28_i686.whl", hash = "sha256:0ead24d2562a49473dddd9efef8581f020007eb0054389c3ee3ffad38b1ca4c9", size = 683847, upload-time = "2026-09-29T00:54:00.671Z" },
+    { url = "https://files.pythonhosted.org/packages/a3/75/f52aeecd4dbadbddf80725ba7de126d8bd5d0eb66247eae17a81ed90dd4d/librt-0.16.0-cp314-cp314t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:02118f56a9c36ddd07dfd9b919d9ecc117ba20a90987d56aa4c429fa34509188", size = 698045, upload-time = "2026-09-29T00:54:02.247Z" },
+    { url = "https://files.pythonhosted.org/packages/e6/55/fa277a835cd6eb42380591ceb85f48c5b4d2b2d7e2cb9869e1e17d24d237/librt-0.16.0-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:4e29522c62e28595ff7e324c6834ade51127707f0e255b18d1c1cf03d39c1048", size = 724640, upload-time = "2026-09-29T00:54:04.078Z" },
+    { url = "https://files.pythonhosted.org/packages/25/e4/2cf64354f3fde8ebd591b3b48f96510bee24ac5f7d1e567adbbe210abdbd/librt-0.16.0-cp314-cp314t-manylinux_2_34_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:3ff4b2367926b69c6215635902cccb04048e73094e9862900d27cb2c6bbff143", size = 731748, upload-time = "2026-09-29T00:54:05.741Z" },
+    { url = "https://files.pythonhosted.org/packages/f8/c9/c180af3e94e01aa529fa93d7733fec2abc47f222345400cf21d5481d5f8a/librt-0.16.0-cp314-cp314t-musllinux_1_2_aarch64.whl", hash = "sha256:c6f1b27bf1632a7e016af9f145f82be95e1edd7721a646505c21059257cb5a04", size = 754960, upload-time = "2026-09-29T00:54:07.38Z" },
+    { url = "https://files.pythonhosted.org/packages/95/d6/01073aa78c58f356b10d9c57b3fe9abb143df338142bcd316df417b89db0/librt-0.16.0-cp314-cp314t-musllinux_1_2_i686.whl", hash = "sha256:5696d7f52e7b37217cb3a8f92c744fe835942602fdd4c1a8bc4741d3bfdce15e", size = 747000, upload-time = "2026-09-29T00:54:09.06Z" },
+    { url = "https://files.pythonhosted.org/packages/f7/d8/1de3783908658d697a8cfc00582f61299ffba7796d7260c112e4700b1109/librt-0.16.0-cp314-cp314t-musllinux_1_2_ppc64le.whl", hash = "sha256:6072e92dd876ff6ceeb6cf371e35e51f479349837391341f479b08df4564242b", size = 749569, upload-time = "2026-09-29T00:54:10.702Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/32/e817f66c96d6caa8bb8435ff93c4c220624d59efc506be59ab98fcd01d0c/librt-0.16.0-cp314-cp314t-musllinux_1_2_riscv64.whl", hash = "sha256:39ca4f2f2fe05de8e63493da592d84311adabe5bef52b193851981da9816b302", size = 729483, upload-time = "2026-09-29T00:54:12.25Z" },
+    { url = "https://files.pythonhosted.org/packages/7c/c9/23992ccd2b9d22798fdd0f61353183a47414e651da782ad83eb680f50833/librt-0.16.0-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:f9807485a908f00355820f18e91e045ffdcdc5adb68aaec40a1e2b88c5f7bba1", size = 776584, upload-time = "2026-09-29T00:54:13.837Z" },
+    { url = "https://files.pythonhosted.org/packages/67/3b/e8af957f08e6e2e8e566b099e43d2748418aa565df6ee1d9d3331209fdfe/librt-0.16.0-cp314-cp314t-win32.whl", hash = "sha256:94be5cb7bca4df6201f4183e9e4fa2086c655283d20b38cd84500a69057575a7", size = 104402, upload-time = "2026-09-29T00:54:15.568Z" },
+    { url = "https://files.pythonhosted.org/packages/ca/1c/946e6443d7cd32347a086043395e421e52fd603c9163d2ec970ceab8eed6/librt-0.16.0-cp314-cp314t-win_amd64.whl", hash = "sha256:d46ca272b251d033dd4527b0dec5f261a28a52bd5fa0f99c117b0a1f8588cc2d", size = 126227, upload-time = "2026-09-29T00:54:17.165Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/a3/bc4f9959d3c62bcbf9e5fd3470a8bbd8bf33224ed4c25d7fba173201b8ac/librt-0.16.0-cp314-cp314t-win_arm64.whl", hash = "sha256:b9d6d4b14e92d876f8026b54c20c445f36425214c1081dc76f74e40db386b82b", size = 116493, upload-time = "2026-09-29T00:54:18.567Z" },
+    { url = "https://files.pythonhosted.org/packages/b6/4b/10fdb42dfab4c1533e1570e686b18e86ff4328b406361b39fb3016667638/librt-0.16.0-cp315-cp315-macosx_10_15_x86_64.whl", hash = "sha256:6fe436af2eaf630474f491af5d032cbe45f93fcff5c3b9fe4ab194a7255b20ff", size = 149829, upload-time = "2026-09-29T00:54:19.933Z" },
+    { url = "https://files.pythonhosted.org/packages/8e/30/a90ca13f1d3d91af1680000a4038536907018fbd51764767287a05d28b8b/librt-0.16.0-cp315-cp315-macosx_11_0_arm64.whl", hash = "sha256:8ff5d26c529336be9bd7ae04483235d77778ee7d6444a95353102b542601ce81", size = 154522, upload-time = "2026-09-29T00:54:21.306Z" },
+    { url = "https://files.pythonhosted.org/packages/5c/dd/bcf364eacfa070bb1fc88d503111ae7177914197ba1fa717c748926e7930/librt-0.16.0-cp315-cp315-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:909d8e3c1faee44cb762b1c519ff8613dcc5ceae5c99987a00917b5a31fd1d6a", size = 497593, upload-time = "2026-09-29T00:54:22.798Z" },
+    { url = "https://files.pythonhosted.org/packages/18/c1/2c4e81e347bdabfe8346bfc6dc37ae5e154d61c88e30848ec0606025a5e0/librt-0.16.0-cp315-cp315-manylinux2014_i686.manylinux_2_17_i686.manylinux_2_28_i686.whl", hash = "sha256:6d4a64283ee61824b5790de882bc68e2d9d7a5143537cb7a966f7354f71646d4", size = 480459, upload-time = "2026-09-29T00:54:24.364Z" },
+    { url = "https://files.pythonhosted.org/packages/ab/d7/fef2a3cb8400701be496f6e459876f650b3451f407e30cb243de571ae615/librt-0.16.0-cp315-cp315-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:5810ba811297fdf37a1531a57667cb8ace0842013ca8606bf9eb7c24cf4be154", size = 507814, upload-time = "2026-09-29T00:54:25.997Z" },
+    { url = "https://files.pythonhosted.org/packages/e1/6f/53762927a32e9dc9eb1d1c1f3528da281290c86d96929a8af652f671266e/librt-0.16.0-cp315-cp315-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:e56aaf8c167548dc8e5d6f3bd0f48dcdd299a23c73be3f744aab79d99e9c7f5d", size = 525114, upload-time = "2026-09-29T00:54:27.747Z" },
+    { url = "https://files.pythonhosted.org/packages/6c/67/0b9d031f303c4e8c691a9a8ef9d272f13b530c11cc563b819df621b6a348/librt-0.16.0-cp315-cp315-manylinux_2_34_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:8f36c58e33b304b525c6c9c5076399c6ebf1109e17b9051a05a407b091b9215b", size = 520465, upload-time = "2026-09-29T00:54:29.331Z" },
+    { url = "https://files.pythonhosted.org/packages/ae/d5/2056a3a85864e882eb17a203a10ddb26fa748bc9718ec67e79059ab46cae/librt-0.16.0-cp315-cp315-musllinux_1_2_aarch64.whl", hash = "sha256:242e00b3d4fa37c3d3c1ca5f5c9adb7d909ddb1eac9c41f2787320d00caa0af2", size = 537257, upload-time = "2026-09-29T00:54:30.915Z" },
+    { url = "https://files.pythonhosted.org/packages/54/57/e0d79790c163cbc0909e209a6f62e30bb713b647f905a176cdc64848fd4d/librt-0.16.0-cp315-cp315-musllinux_1_2_i686.whl", hash = "sha256:0253721561787b8df8443eb347b7a6461015354e5bdd37ee38a41fef220d2bb0", size = 527442, upload-time = "2026-09-29T00:54:32.478Z" },
+    { url = "https://files.pythonhosted.org/packages/aa/50/1c0c95aba7af51f4752ea34fbf2eb79b36e7cae3a72536248e8c735de735/librt-0.16.0-cp315-cp315-musllinux_1_2_ppc64le.whl", hash = "sha256:3e483a8d69ede8067db70c0e83007423b6925de6fd53afed01d66160f2e9398c", size = 548139, upload-time = "2026-09-29T00:54:34.183Z" },
+    { url = "https://files.pythonhosted.org/packages/98/91/a8a43dd5138d4f55f88846b8f0c85454a4fad69952cebfcff9948f831290/librt-0.16.0-cp315-cp315-musllinux_1_2_riscv64.whl", hash = "sha256:69ba927445cfaaffb4081003ef5224c55a5c2ab67ef956f416ef744916e44121", size = 529708, upload-time = "2026-09-29T00:54:35.761Z" },
+    { url = "https://files.pythonhosted.org/packages/2d/41/d5226881ab2b7c20d9d587b37bdd4a0ec8775a96d00ca87ac9f385587db4/librt-0.16.0-cp315-cp315-musllinux_1_2_x86_64.whl", hash = "sha256:d6a365f2ab45a984d0e00eee0dd17f599ceab8cadab6ea07b6111c8132fc0e42", size = 567781, upload-time = "2026-09-29T00:54:37.409Z" },
+    { url = "https://files.pythonhosted.org/packages/bb/bf/2345ba57a626e8c78c4ddcc724636a8df5a593fe46c1ee76bbf477e32b0d/librt-0.16.0-cp315-cp315-pyemscripten_2026_5_wasm32.whl", hash = "sha256:f01f3805f2dae4781c0c34b440e31740d082950bdaf89a6f601ad589a28af57a", size = 79177, upload-time = "2026-09-29T00:54:38.792Z" },
+    { url = "https://files.pythonhosted.org/packages/1e/40/99e77936cc9207f629b077bf7cbc5e2f0827cddd7c29792f04ef881bd2c3/librt-0.16.0-cp315-cp315-win32.whl", hash = "sha256:b0e3e721c75d2e79a76d4422c79d7ba705fe1bbafec907037fe7a657a480a0e3", size = 100127, upload-time = "2026-09-29T00:54:40.251Z" },
+    { url = "https://files.pythonhosted.org/packages/56/1e/801fe26bc622061b9dfd010e166d94142cb774b733217e6d98d1c0cf2638/librt-0.16.0-cp315-cp315-win_amd64.whl", hash = "sha256:bc02954b1295de798bbdb0b4e2d8a28c2117de8b5c73dcbeb27dc32572dfb971", size = 120480, upload-time = "2026-09-29T00:54:41.722Z" },
+    { url = "https://files.pythonhosted.org/packages/bb/a9/d533983055bd36e112627384c2c038845d1df882540b8bcefb566475640b/librt-0.16.0-cp315-cp315-win_arm64.whl", hash = "sha256:c5db585d43449a5f54303d4b2774e45e1babd975cfe1630a3d708c0b80c3e560", size = 110915, upload-time = "2026-09-29T00:54:43.052Z" },
+    { url = "https://files.pythonhosted.org/packages/55/fe/d62238fa9c653b0e0613290349467cb65711b5800e8e474f45e942a0ad95/librt-0.16.0-cp315-cp315t-macosx_10_15_x86_64.whl", hash = "sha256:f06c689cb14afd9b612727553a5ec5a40febf113ca41c4413a2b0b334285884b", size = 159714, upload-time = "2026-09-29T00:54:44.497Z" },
+    { url = "https://files.pythonhosted.org/packages/f3/ac/f31efe7818700be72ba4f9af8a80fa67c39808c8d26dacc55dc1f6f35172/librt-0.16.0-cp315-cp315t-macosx_11_0_arm64.whl", hash = "sha256:13b4e8aba90b0b1c82474e9844aa9ffe7ad3faa484350e1da64cb8188d903134", size = 162086, upload-time = "2026-09-29T00:54:45.968Z" },
+    { url = "https://files.pythonhosted.org/packages/d9/16/4d7487bf86a9d7e8e18f37ba5538789233ea693637379b75701bd35ec9de/librt-0.16.0-cp315-cp315t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:5a269c46ae327d8e6f8c1f85f7516cb52c0fa48127565a1105a4f4a05ff2a0b4", size = 712727, upload-time = "2026-09-29T00:54:47.486Z" },
+    { url = "https://files.pythonhosted.org/packages/77/74/50cd550ccc1a517b9ed62347625c01ddf8c4afad66490312677c011458f6/librt-0.16.0-cp315-cp315t-manylinux2014_i686.manylinux_2_17_i686.manylinux_2_28_i686.whl", hash = "sha256:a33e0dae1f8592146a4764d54ce842b278732d21a84e17c3bbe6b1bc158a2248", size = 681106, upload-time = "2026-09-29T00:54:49.126Z" },
+    { url = "https://files.pythonhosted.org/packages/df/5d/7293f712975ee6fdd2251411fd9ef1c62bc99c7b83ecbe62dbc999b1fab7/librt-0.16.0-cp315-cp315t-manylinux2014_ppc64le.manylinux_2_17_ppc64le.manylinux_2_28_ppc64le.whl", hash = "sha256:47ada6ea32636492c61aa8ad27ae3b9404bfe7a97e3ba946d1984236cc741da0", size = 705921, upload-time = "2026-09-29T00:54:50.905Z" },
+    { url = "https://files.pythonhosted.org/packages/67/f7/8aab946f11d59d1bece9ffc65d994b200c789a8ca5a95c17e17e609f912a/librt-0.16.0-cp315-cp315t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:c43bd6e642d8a248c114327f98dd25ac5a7cb5aa168ef02f0559b91874df16b8", size = 731786, upload-time = "2026-09-29T00:54:52.584Z" },
+    { url = "https://files.pythonhosted.org/packages/43/76/1c42ab31e7cb8384ebf6d3af607213c495222474f4940443ae7639ab7685/librt-0.16.0-cp315-cp315t-manylinux_2_34_riscv64.manylinux_2_39_riscv64.whl", hash = "sha256:c3d1bb7841a816ace6449bb26d3f9560dbfa20e71c568d23f0f62bf1e68f50b1", size = 744964, upload-time = "2026-09-29T00:54:54.217Z" },
+    { url = "https://files.pythonhosted.org/packages/6f/2e/4b19982d933d2dfced671e840b219e4c1cd3f507df6e6dabb51bbd4e3850/librt-0.16.0-cp315-cp315t-musllinux_1_2_aarch64.whl", hash = "sha256:3931f7a3db322e7f44e02a280e3949326ce9579ad388ee8d691dc7c76da9fb70", size = 765305, upload-time = "2026-09-29T00:54:55.815Z" },
+    { url = "https://files.pythonhosted.org/packages/b8/1b/e872583de2dcb3ac7746e7a2321aeeb168274f3952a87dc66e05ddb29faf/librt-0.16.0-cp315-cp315t-musllinux_1_2_i686.whl", hash = "sha256:f4462528b6000afe8f16907b5c7c2553abf1df005ba5140e6eb394541c3624c3", size = 744959, upload-time = "2026-09-29T00:54:57.532Z" },
+    { url = "https://files.pythonhosted.org/packages/10/de/a18c6bcfb297af2674233e90b3c3661c3a0af0f1434a0c966d2ef708a835/librt-0.16.0-cp315-cp315t-musllinux_1_2_ppc64le.whl", hash = "sha256:80039ba9b6a7d5f1a0175a4cca6bbefead87bd854c80abad1cb30afe47a830db", size = 758138, upload-time = "2026-09-29T00:54:59.484Z" },
+    { url = "https://files.pythonhosted.org/packages/22/1c/0df1d732539c297bb1a093e1fe3204d2faf76a9022cf4e1d1c2fce059790/librt-0.16.0-cp315-cp315t-musllinux_1_2_riscv64.whl", hash = "sha256:7a1d272724b581bb6bc769dfdafed6da2ecc9886ba2450311de55a4ac2e1e9cd", size = 744268, upload-time = "2026-09-29T00:55:01.179Z" },
+    { url = "https://files.pythonhosted.org/packages/a2/f7/ccaf31331f20c91a5bd9bd48ffc3f743f9c81bb5720cc7b2a720ca204f0a/librt-0.16.0-cp315-cp315t-musllinux_1_2_x86_64.whl", hash = "sha256:fbe4fb8c5445f7496d7f7f6bb0807875d09d47e6771ffa175fb2df2895fb86ba", size = 785783, upload-time = "2026-09-29T00:55:02.938Z" },
+    { url = "https://files.pythonhosted.org/packages/c1/ea/7421d9e6db894cd6cd788b604b3394a163ded6b942052b6f96c23ccf08e1/librt-0.16.0-cp315-cp315t-win32.whl", hash = "sha256:375bfe6b572a8f6cfc398709356046173bf27e64c4c5edaf5f7062f051fb4bf9", size = 104355, upload-time = "2026-09-29T00:55:04.533Z" },
+    { url = "https://files.pythonhosted.org/packages/85/6d/7c31a506eb847bc58aeb2402d58e17605e821f68ab5df5e66fe274a6df41/librt-0.16.0-cp315-cp315t-win_amd64.whl", hash = "sha256:bd3150023d3dc2bc70f3784e59ffa1140d56ddba3d8125b3d6f9f85221279bfc", size = 126134, upload-time = "2026-09-29T00:55:06.017Z" },
+    { url = "https://files.pythonhosted.org/packages/36/69/7a5d10ac409c4da0355e054a14371871da9b5557fcc42772cd00181c6cce/librt-0.16.0-cp315-cp315t-win_arm64.whl", hash = "sha256:8ceafb70f2a4f0826f11031942e59c0728fd98da112dc346d4352bde1e486866", size = 116391, upload-time = "2026-09-29T00:55:07.484Z" },
+]
+
+[[package]]
+name = "markdown-it-py"
+version = "4.2.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "mdurl" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/06/ff/7841249c247aa650a76b9ee4bbaeae59370dc8bfd2f6c01f3630c35eb134/markdown_it_py-4.2.0.tar.gz", hash = "sha256:04a21681d6fbb623de53f6f364d352309d4094dd4194040a10fd51833e418d49", size = 82454, upload-time = "2026-05-07T12:08:28.36Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/b3/81/4da04ced5a082363ecfa159c010d200ecbd959ae410c10c0264a38cac0f5/markdown_it_py-4.2.0-py3-none-any.whl", hash = "sha256:9f7ebbcd14fe59494226453aed97c1070d83f8d24b6fc3a3bcf9a38092641c4a", size = 91687, upload-time = "2026-05-07T12:08:27.182Z" },
+]
+
+[[package]]
+name = "mdurl"
+version = "0.1.2"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d6/54/cfe61301667036ec958cb99bd3efefba235e65cdeb9c84d24a8293ba1d90/mdurl-0.1.2.tar.gz", hash = "sha256:bb413d29f5eea38f31dd4754dd7377d4465116fb207585f97bf925588687c1ba", size = 8729, upload-time = "2022-08-14T12:40:10.846Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/b3/38/89ba8ad64ae25be8de66a6d463314cf1eb366222074cfda9ee839c56a4b4/mdurl-0.1.2-py3-none-any.whl", hash = "sha256:84008a41e51615a49fc9966191ff91509e3c40b939176e643fd50a5c2196b8f8", size = 9979, upload-time = "2022-08-14T12:40:09.779Z" },
+]
+
+[[package]]
+name = "mypy"
+version = "2.4.1"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "ast-serialize" },
+    { name = "librt", marker = "platform_python_implementation != 'PyPy'" },
+    { name = "mypy-extensions" },
+    { name = "pathspec" },
+    { name = "typing-extensions" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/4a/3c/78ecece71ee4b5445389a4ccd11627cfb9c69e4de554d11060171f376305/mypy-2.4.1.tar.gz", hash = "sha256:63b590965691e540a335fa74dadf31a7069142f6b72e234689bbd244edf55623", size = 4066728, upload-time = "2026-10-28T19:23:13.286Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/4b/8b/2bc7f489528db504221ad7eff6b3f83979ee57d066103c72a85d09046a30/mypy-2.4.1-cp311-cp311-macosx_11_0_arm64.whl", hash = "sha256:79a1e79199e980fb41f219cb3d4746d25c64b0b623840d3ed57df1cdc13a6502", size = 14321495, upload-time = "2026-10-28T19:21:16.612Z" },
+    { url = "https://files.pythonhosted.org/packages/18/9a/b2f037b4982dce33645296e4394b031ade60f697f468761fa3ea8e2f8ece/mypy-2.4.1-cp311-cp311-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:4e18d0da3898b3bcd16192f15a206e7b8b8dd0f4a0b3e51aa5bd5c2afe749e2c", size = 14467468, upload-time = "2026-10-28T19:22:10.629Z" },
+    { url = "https://files.pythonhosted.org/packages/c4/5a/379f9bfa18bf3f8d43668fbd9ae4f2922dd027a559c461ca9d41cde1d32e/mypy-2.4.1-cp311-cp311-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:b69a15fc2e75858d6b15e91ed3a0dcff1a533265183b64734138791fe0f49aa5", size = 15421496, upload-time = "2026-10-28T19:22:48.005Z" },
+    { url = "https://files.pythonhosted.org/packages/83/50/3bde18a2824ec296432cebe01752ccd0ab8a2ad784abe4390040d019b3bf/mypy-2.4.1-cp311-cp311-musllinux_1_2_x86_64.whl", hash = "sha256:70971cc0bcb1d3f03d2eb68fa430a6481ccc03558dc001d9534d7e5fa274c392", size = 15670425, upload-time = "2026-10-28T19:21:57.026Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/36/8b722b88c325d317354de7d10d8fb9d4dc0f958433e873a91fc4ed21a06e/mypy-2.4.1-cp311-cp311-win_amd64.whl", hash = "sha256:6f7225951a277dd0d6add900731d487174b7d24ac133c09d670ed63b4d8cb90d", size = 11300972, upload-time = "2026-10-28T19:21:48.724Z" },
+    { url = "https://files.pythonhosted.org/packages/c2/d6/fb2bab1245658d68af8abfe776362a780c621fe0f364f2c7b53039a945ee/mypy-2.4.1-cp311-cp311-win_arm64.whl", hash = "sha256:be4c03f33c55500191df2ed4a9b5e7edbdd1fff067fe361a5a9b1b5d3262da6e", size = 10873349, upload-time = "2026-10-28T19:21:32.104Z" },
+    { url = "https://files.pythonhosted.org/packages/c0/1a/0be9dc6af5e0e04128f18a5e36b4ca44bfb0085857d37aa6a7de1ac2b0cb/mypy-2.4.1-cp312-cp312-macosx_11_0_arm64.whl", hash = "sha256:d63737426a048a27705a4eedb828669f4bc0873612a1b46b0b9fe892b2ebaaaf", size = 14381321, upload-time = "2026-10-28T19:21:54.223Z" },
+    { url = "https://files.pythonhosted.org/packages/0d/a6/7907e36711a8a8c703f961f076fab61793383694140bd1fd87589f3f68d4/mypy-2.4.1-cp312-cp312-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:7344869cad05f073b8cae2826774fa0161e3eb2f5c685b76813574008d77d750", size = 14466373, upload-time = "2026-10-28T19:22:25.211Z" },
+    { url = "https://files.pythonhosted.org/packages/5d/b8/7313212b29de570c25c9859d7c8e4ef2251a6d34338a1e20031d94297721/mypy-2.4.1-cp312-cp312-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:a20ff6cd2af7a670c64f089bfa5fbcebe8ff3bf896c5e6ac7c9862c7960e4494", size = 15553666, upload-time = "2026-10-28T19:22:36.511Z" },
+    { url = "https://files.pythonhosted.org/packages/23/8f/92966b6082ff49da9142e1e527eb9af4359a9a61632a1cfc313da96b37fe/mypy-2.4.1-cp312-cp312-musllinux_1_2_x86_64.whl", hash = "sha256:9ed1195502cca32be5ef756b1693477f4991db2f2e34eaa90cc4ad6bea4f9531", size = 15802641, upload-time = "2026-10-28T19:21:13.421Z" },
+    { url = "https://files.pythonhosted.org/packages/b6/b4/874f6fd54b005020ad63e2cf7a59b178d16a771d478849b29b842cb0cf14/mypy-2.4.1-cp312-cp312-win_amd64.whl", hash = "sha256:4c194c5d878130fca1ae662dfb1feb6274afbab0b40032c80147377e0ea803d5", size = 11383067, upload-time = "2026-10-28T19:22:03.516Z" },
+    { url = "https://files.pythonhosted.org/packages/b0/41/5ae8e6528c2faa96e4a921a999d2c7ac7c565bee184b4282bf62ffa76b5d/mypy-2.4.1-cp312-cp312-win_arm64.whl", hash = "sha256:71eda06e5bae51976ce869fda429159c9cec678bd02f25bb197f0265c8f991be", size = 10946882, upload-time = "2026-10-28T19:21:39.51Z" },
+    { url = "https://files.pythonhosted.org/packages/6a/65/cd19bc06b67d2df4828220245fd98569ba40fac00c60ba48bef1817d8ac3/mypy-2.4.1-cp313-cp313-macosx_11_0_arm64.whl", hash = "sha256:3f1613bfe6726169a5680ec3dad5fe1f6d96285c12aded51ad432eadedd39d45", size = 14214179, upload-time = "2026-10-28T19:22:27.49Z" },
+    { url = "https://files.pythonhosted.org/packages/c9/db/4d54ca4f49a0113d0c956980272aefdc6eec5458f7a72b350785b9ef2249/mypy-2.4.1-cp313-cp313-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:680ba5d9f0e3fe0c746b3d14df15f2a718e4bc308a1145616a1ea691ce7c354b", size = 14376217, upload-time = "2026-10-28T19:21:08.019Z" },
+    { url = "https://files.pythonhosted.org/packages/a2/45/089b4724b85f0f408941be5298f817ee89181c1ce031a73d60ebb150c2c7/mypy-2.4.1-cp313-cp313-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:1fb70621535c22fd4b1a0450d37ed1d6c5eb39656a1cebfb189084c12de54ba7", size = 15467623, upload-time = "2026-10-28T19:21:21.555Z" },
+    { url = "https://files.pythonhosted.org/packages/27/4c/15edbc64b0b1412bfe94c74192b3b56554ab642b85a31bb06cef6313101f/mypy-2.4.1-cp313-cp313-musllinux_1_2_x86_64.whl", hash = "sha256:4af5ad558033bf71a44a1be149ed61633522824f84c1b6bc2445d3fe2d2a5296", size = 15729867, upload-time = "2026-10-28T19:21:37.557Z" },
+    { url = "https://files.pythonhosted.org/packages/76/5b/7d160fb685994b65b0ca86d352f3afb5424f96a9e6914719f7b861fb6701/mypy-2.4.1-cp313-cp313-win_amd64.whl", hash = "sha256:acdd82cb3a2eb10720e87706a128d75785d005a8c47e36a4973221524f41fc56", size = 11390802, upload-time = "2026-10-28T19:22:18.081Z" },
+    { url = "https://files.pythonhosted.org/packages/9a/ea/453d27f8d531f57c5f14aa73094eaa48e3fb77f680bdede2045cb64fa58b/mypy-2.4.1-cp313-cp313-win_arm64.whl", hash = "sha256:133886ef1a7a8cf673df55d865e41580c6c46aa9b8e31e1325dfe315c038f745", size = 10950427, upload-time = "2026-10-28T19:22:59.003Z" },
+    { url = "https://files.pythonhosted.org/packages/7d/75/282d43d6fea7be984ac63e75ffd8eee146ba2f3b077bb1ca5bf3f973e0c4/mypy-2.4.1-cp314-cp314-macosx_11_0_arm64.whl", hash = "sha256:c45485061ba08f700acc12cfc8b177e6997e6bc353605babfc0abb081e079456", size = 14233251, upload-time = "2026-10-28T19:22:44.977Z" },
+    { url = "https://files.pythonhosted.org/packages/ac/a8/9021263cc7e761451c7d8131bdfab3c0a5c2d67aa2d694670019e1ab86a7/mypy-2.4.1-cp314-cp314-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:727890a32f1858c09549eb55a8b234fe990d460450b28f03e8213ef925f1247c", size = 14394953, upload-time = "2026-10-28T19:21:29.492Z" },
+    { url = "https://files.pythonhosted.org/packages/16/10/4192a5cea09ebbc41c534f57bd0d8f0fb42a8e810632cda6e37f072c59fd/mypy-2.4.1-cp314-cp314-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:beb254fec368c4e7f7f82a5f310c6470b893ec88a90b66426da971c6826b0453", size = 15442824, upload-time = "2026-10-28T19:22:42.068Z" },
+    { url = "https://files.pythonhosted.org/packages/99/e6/d3b0a7474aa4f696594a47a218b6796d9c4346fc81ed288904278cddd9bd/mypy-2.4.1-cp314-cp314-musllinux_1_2_x86_64.whl", hash = "sha256:ec416d5d2ae689e681f5727e328723f18d8b5dc8c903a146b7851dc5727aad8a", size = 15717227, upload-time = "2026-10-28T19:22:54.026Z" },
+    { url = "https://files.pythonhosted.org/packages/48/6a/2ec530dacd4f77ca50d0fa05b854098f2d75e5d18c587d2612b44f10d68c/mypy-2.4.1-cp314-cp314-pyemscripten_2026_0_wasm32.whl", hash = "sha256:0e95ad0bec03ced9a73b42514208abd24c789e67f0e1eba476e276dd7a2dea3a", size = 7898637, upload-time = "2026-10-28T19:21:41.709Z" },
+    { url = "https://files.pythonhosted.org/packages/cc/56/de9d7bad12e3868d5f1f4279aed20b1b568b2c5e166f2d3a05b211dca0b1/mypy-2.4.1-cp314-cp314-win_amd64.whl", hash = "sha256:51f742d4154824837ca6e92aa81f00eec222700a3c337bd258e5562a3880d75a", size = 11576656, upload-time = "2026-10-28T19:22:13.232Z" },
+    { url = "https://files.pythonhosted.org/packages/b8/12/4fa9883b9b59e5c96ff62845ad019dc47786031c45d67eaccf452cffffd8/mypy-2.4.1-cp314-cp314-win_arm64.whl", hash = "sha256:f44dd4c5ab22df21206dd926c98381ebdbf5bfd696df37dd38ded2d23143fcb6", size = 11174403, upload-time = "2026-10-28T19:23:01.346Z" },
+    { url = "https://files.pythonhosted.org/packages/3f/f2/827e356fc4f74c60b8da42663336e035b49d948a3c11224b0fc7543086b1/mypy-2.4.1-cp314-cp314t-macosx_11_0_arm64.whl", hash = "sha256:2875280687e64740e6ddcef43bd4c5852ad45ff34549740f6aea3f0373870b93", size = 15713427, upload-time = "2026-10-28T19:21:26.757Z" },
+    { url = "https://files.pythonhosted.org/packages/a2/fa/e58a4fcae1d238189eac758036c0921992a86e3e6209190efd96d61fc5d4/mypy-2.4.1-cp314-cp314t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:ea0714d2bccaf6d010c970e1d3ba2c9c2add79d2030aad2ef03167d788948276", size = 15938481, upload-time = "2026-10-28T19:22:34.371Z" },
+    { url = "https://files.pythonhosted.org/packages/a1/54/a20f881801b88900923f2be1541a4b438ad0f0883e03836641fdc3d7adf4/mypy-2.4.1-cp314-cp314t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:63c6ff0e7ea546943001a91639c9f0c64b60d239268fa5d29e4a6c87f82c2373", size = 17243006, upload-time = "2026-10-28T19:22:39.425Z" },
+    { url = "https://files.pythonhosted.org/packages/de/1c/ff84a6133a6e89c390bff6b25d9bad6598e7891b205f4b30b496906d636d/mypy-2.4.1-cp314-cp314t-musllinux_1_2_x86_64.whl", hash = "sha256:a5b5da107dc2c93fb0a22f7a45dbaea5dc131afc7056b5468d78e819f9a138e6", size = 17557728, upload-time = "2026-10-28T19:21:43.607Z" },
+    { url = "https://files.pythonhosted.org/packages/15/4a/effa47d39b8fadf679c08e7c78559e523f9769a42a75662d2d15b2b9cdd6/mypy-2.4.1-cp314-cp314t-win_amd64.whl", hash = "sha256:c3a4d0c47053cc90035dd3a2c321112b593ad42935d0cbfd747288e1564fa8ca", size = 12370826, upload-time = "2026-10-28T19:22:29.779Z" },
+    { url = "https://files.pythonhosted.org/packages/46/9f/b214ececb1a97fbb61ab3dfd48ae3cffd92ae2c148af4c9dc94c6c56772b/mypy-2.4.1-cp314-cp314t-win_arm64.whl", hash = "sha256:0c5bf267645351887b72903fd2f5fbddcf85234e0e6c4ad94e2fcfb4f0c3f971", size = 11851083, upload-time = "2026-10-28T19:23:11.288Z" },
+    { url = "https://files.pythonhosted.org/packages/57/5b/e44a2edb0b25a9f1429de770e1d0238af23302671dd40c77ac5efeb0c559/mypy-2.4.1-cp315-cp315-macosx_11_0_arm64.whl", hash = "sha256:db599d03e7d60d15f2e0a11665c18bc52a88699fcab990fdf8cecd5be8ac801c", size = 14243144, upload-time = "2026-10-28T19:21:10.975Z" },
+    { url = "https://files.pythonhosted.org/packages/59/d4/5c99dc3a28e11d2f0fcbb02df63d2d3e574dedc0f9f69d50901df305a7a6/mypy-2.4.1-cp315-cp315-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:c6c7210e40dd423af7d65cbe428b5906d11dc60659337bdae4e5fdf02ce32ed7", size = 14409316, upload-time = "2026-10-28T19:22:15.515Z" },
+    { url = "https://files.pythonhosted.org/packages/c3/c9/3108b38f4c30eabd80194f5d9771a87e27196c5e0ddb5bf4b99c6ed1e97e/mypy-2.4.1-cp315-cp315-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:a2d4a51db92059eecc2c33b2a5194b28585ebfd917292c015fe87a77dbff6cd2", size = 15445573, upload-time = "2026-10-28T19:22:05.635Z" },
+    { url = "https://files.pythonhosted.org/packages/dd/12/84a53eceaf11c46dfd7931fb6b8902d01fb33787d3a991e81c461458150b/mypy-2.4.1-cp315-cp315-musllinux_1_2_x86_64.whl", hash = "sha256:01b7718552d017f88d1151f3cc9d6556d778a90bd58060a2c3d87d070f9099fb", size = 15732989, upload-time = "2026-10-28T19:23:06.512Z" },
+    { url = "https://files.pythonhosted.org/packages/65/ba/bf017dc2abdf83b2f74e29c43834b7af67dc1f1b20202f02dae60b4781a0/mypy-2.4.1-cp315-cp315-pyemscripten_2026_5_wasm32.whl", hash = "sha256:3467b1d13000812ab85dc2a3834b9379ec77798ca1bcabe434e23fb21fead692", size = 7898932, upload-time = "2026-10-28T19:21:59.366Z" },
+    { url = "https://files.pythonhosted.org/packages/76/05/0c22b1f0390120a8592d31209cb6b9f932b6a0b426fe643e550de15139e3/mypy-2.4.1-cp315-cp315-win_amd64.whl", hash = "sha256:080cf64a60b90a73435542feecf4171904cc5710658165b40c6869115d4aa100", size = 11577577, upload-time = "2026-10-28T19:22:01.302Z" },
+    { url = "https://files.pythonhosted.org/packages/73/fb/ac01e173629697ddac2f11e51efd10347d673f9a7311b03f4aba710ebccd/mypy-2.4.1-cp315-cp315-win_arm64.whl", hash = "sha256:f9118a3f50de264b614861bb11814833a742138ac3c8e2e49a860b6977fb2704", size = 11173540, upload-time = "2026-10-28T19:21:46.444Z" },
+    { url = "https://files.pythonhosted.org/packages/5b/e4/b9b9c8eb09e70927ee65b1456cfed35710b6e4ff0b07f364ceaf2202307c/mypy-2.4.1-cp315-cp315t-macosx_11_0_arm64.whl", hash = "sha256:9d7dafd56179d296651df9e1844b91c9517c379398f017a2a435d077a28943c1", size = 15706623, upload-time = "2026-10-28T19:22:20.528Z" },
+    { url = "https://files.pythonhosted.org/packages/26/74/1ceb1ca884add0565e618d013dd24333039100dc0fcc42661561f2e1cae5/mypy-2.4.1-cp315-cp315t-manylinux2014_aarch64.manylinux_2_17_aarch64.manylinux_2_28_aarch64.whl", hash = "sha256:d923cec43316f0e6736b8298fd00abeaaf348a091c20e7296b3aebceecb63eca", size = 15944095, upload-time = "2026-10-28T19:21:04.779Z" },
+    { url = "https://files.pythonhosted.org/packages/2b/68/27bcf9b4efa22733b6050485ae37845b94c9b8851abe4fc60632d905c32d/mypy-2.4.1-cp315-cp315t-manylinux2014_x86_64.manylinux_2_17_x86_64.manylinux_2_28_x86_64.whl", hash = "sha256:d6e081b466e88d4343adffe11aff0f02df34b5b9070b4b700053a0b7294c0be1", size = 17223065, upload-time = "2026-10-28T19:23:03.724Z" },
+    { url = "https://files.pythonhosted.org/packages/1a/a3/ed5724b317bf585c29f3c8be2792e97d45925d65a9c8af40ceeb267072e6/mypy-2.4.1-cp315-cp315t-musllinux_1_2_x86_64.whl", hash = "sha256:70196470ac300f444a302a738541101893c2c57804078b33690286a7899149e9", size = 17560589, upload-time = "2026-10-28T19:21:34.539Z" },
+    { url = "https://files.pythonhosted.org/packages/42/2f/005185e6ab4752fd6cc2d1a6d1421fe21979770afe2490c00c555f34a913/mypy-2.4.1-cp315-cp315t-win_amd64.whl", hash = "sha256:de95648e0a6d46fa9929b956ed2c87c5dc9933d4d59945e6390e9d753c74e7c1", size = 12353324, upload-time = "2026-10-28T19:22:51.481Z" },
+    { url = "https://files.pythonhosted.org/packages/a1/d6/20420cc9c780087139662534d128c2f3274361f8bb7e9cf0d5495a846ed5/mypy-2.4.1-cp315-cp315t-win_arm64.whl", hash = "sha256:ef8d5be90032261197ac388d945d8ff4f476c95880798a1911760af64ddfe71f", size = 11845599, upload-time = "2026-10-28T19:22:23.136Z" },
+    { url = "https://files.pythonhosted.org/packages/21/5c/6e8010f8f2c4ad817364592d4b3883633417269b913fc9d5174fdeb7e565/mypy-2.4.1-py3-none-any.whl", hash = "sha256:1784648d6ec8c2b5465e3f26241b845a0b3cb4e56c993c64abe16989e7698999", size = 2801286, upload-time = "2026-10-28T19:21:19.516Z" },
+]
+
+[[package]]
+name = "mypy-extensions"
+version = "1.2.0"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/d0/6f/43edf3be2748d0e40974a5ee046a8bb4c9961a4bdd3e7d5c6dcbf32d1af6/mypy_extensions-1.2.0.tar.gz", hash = "sha256:c6e275a07f1c2fc096b62940452d0eaa3f3af7de45d704787866240a7c6d5a51", size = 6566, upload-time = "2026-11-03T16:26:33.692Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/b5/99/7b1adac7e97ce7bbda34792dc6e9b2f5cc5cffd1875883f78a818b2a2687/mypy_extensions-1.2.0-py3-none-any.whl", hash = "sha256:993e7a20aa5671eb41a7132cf555af30062da99729601601b9a8382b11cae768", size = 5114, upload-time = "2026-11-03T16:26:32.731Z" },
+]
+
 [[package]]
 name = "packaging"
 version = "26.2"
@@ -193,6 +958,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/df/b2/87e62e8c3e2f4b32e5fe99e0b86d576da1312593b39f47d8ceef365e95ed/packaging-26.2-py3-none-any.whl", hash = "sha256:5fc45236b9446107ff2415ce77c807cee2862cb6fac22b8a73826d0693b0980e", size = 100195, upload-time = "2026-04-24T20:15:22.081Z" },
 ]
 
+[[package]]
+name = "pathspec"
+version = "1.1.1"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/5a/82/42f767fc1c1143d6fd36efb827202a2d997a375e160a71eb2888a925aac1/pathspec-1.1.1.tar.gz", hash = "sha256:17db5ecd524104a120e173814c90367a96a98d07c45b2e10c2f3919fff91bf5a", size = 135180, upload-time = "2026-04-27T01:46:08.907Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/f1/d9/7fb5aa316bc299258e68c73ba3bddbc499654a07f151cba08f6153988714/pathspec-1.1.1-py3-none-any.whl", hash = "sha256:a00ce642f577bf7f473932318056212bc4f8bfdf53128c78bbd5af0b9b20b189", size = 57328, upload-time = "2026-04-27T01:46:07.06Z" },
+]
+
 [[package]]
 name = "pluggy"
 version = "1.6.0"
@@ -202,6 +976,15 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/54/20/4d324d65cc6d9205fabedc306948156824eb9f0ee1633355a8f7ec5c66bf/pluggy-1.6.0-py3-none-any.whl", hash = "sha256:e920276dd6813095e9377c0bc5566d94c932c33b27a3e3945d8389c374dd4746", size = 20538, upload-time = "2025-05-15T12:30:06.134Z" },
 ]
 
+[[package]]
+name = "pycparser"
+version = "3.12"
+source = { registry = "https://pypi.org/simple" }
+sdist = { url = "https://files.pythonhosted.org/packages/cb/27/eeb9f307bf07060f3d9f9aa0fb8c15b01bdfded0a941e4b2719c7f94cacd/pycparser-3.12.tar.gz", hash = "sha256:f03387877eab82ce01bbdfd0ba7252ee55a90b1c708d5129e2ce915475cf1db6", size = 158785, upload-time = "2026-10-22T13:40:03.56Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/b6/ae/315bbeee126a769cbde43cf4908acb4b40408d8bf8bbf334dd7368d8dadf/pycparser-3.12-py3-none-any.whl", hash = "sha256:a076f3f489b39b43ed13563a1dafe42447445bec2e294154ec5c57fcdda4c85e", size = 62600, upload-time = "2026-10-22T13:40:02.021Z" },
+]
+
 [[package]]
 name = "pydantic"
 version = "2.13.4"
@@ -344,6 +1127,33 @@ wheels = [
     { url = "https://files.pythonhosted.org/packages/24/25/1de2678b631f5a49215c6c96fff41ba892b0a34df68d6d80292b1b48aa7f/pytest-9.1.1-py3-none-any.whl", hash = "sha256:37a86b45efb9a47a61a36449063e8e18d0cab3161329fc099eb21783169c4f0c", size = 386536, upload-time = "2026-06-19T10:58:31.347Z" },
 ]
 
+[[package]]
+name = "pytest-cov"
+version = "7.1.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "coverage" },
+    { name = "pluggy" },
+    { name = "pytest" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/b1/51/a849f96e117386044471c8ec2bd6cfebacda285da9525c9106aeb28da671/pytest_cov-7.1.0.tar.gz", hash = "sha256:30674f2b5f6351aa09702a9c8c364f6a01c27aae0c1366ae8016160d1efc56b2", size = 55592, upload-time = "2026-03-21T20:11:16.284Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/9d/7a/d968e294073affff457b041c2be9868a40c1c71f4a35fcc1e45e5493067b/pytest_cov-7.1.0-py3-none-any.whl", hash = "sha256:a0461110b7865f9a271aa1b51e516c9a95de9d696734a2f71e3e78f46e1d4678", size = 22876, upload-time = "2026-03-21T20:11:14.438Z" },
+]
+
+[[package]]
+name = "rich"
+version = "15.0.0"
+source = { registry = "https://pypi.org/simple" }
+dependencies = [
+    { name = "markdown-it-py" },
+    { name = "pygments" },
+]
+sdist = { url = "https://files.pythonhosted.org/packages/c0/8f/0722ca900cc807c13a6a0c696dacf35430f72e0ec571c4275d2371fca3e9/rich-15.0.0.tar.gz", hash = "sha256:edd07a4824c6b40189fb7ac9bc4c52536e9780fbbfbddf6f1e2502c31b068c36", size = 230680, upload-time = "2026-04-12T08:24:00.75Z" }
+wheels = [
+    { url = "https://files.pythonhosted.org/packages/82/3b/64d4899d73f91ba49a8c18a8ff3f0ea8f1c1d75481760df8c68ef5235bf5/rich-15.0.0-py3-none-any.whl", hash = "sha256:33bd4ef74232fb73fe9279a257718407f169c09b78a87ad3d296f548e27de0bb", size = 310654, upload-time = "2026-04-12T08:24:02.83Z" },
+]
+
 [[package]]
 name = "ruff"
 version = "0.15.21"